Truly bypass cache with Workers subrequests

I’m building an API in Workers that takes a URL and returns the name of the CDN that served the URL.
The API will inspect response headers and if no match move on to inspect DNS response.

My challenge is determining if a URL is served from Cloudflare CDN.

Response headers
Inspecting response headers fails because Cloudflare adds several headers to the response of subrequest fetches (e.g. cf-ray, …) and sets the server: cloudflare header.
So, all subrequest responses have these Cloudflare headers and therefore these headers are useless.

DNS
Many Cloudflare sites use Cloudflare DNS too, so inspecting the CNAME (includes .cdn.cloudflare.net) will often not give a good result.

I identified the following ways to tackle my challenge:

  1. DNS: do a PTR query and inspect the data in the Authority section (if that includes cloudflare, the CDN is Cloudflare)
  2. IP to ASN: use a service like https://iptoasn.com/ (if ASN = 13335, the CDN is Cloudflare)

Both are easy to implement, but I’d much rather not add this complexity and be able to identify Cloudflare from the subrequest fetch response headers

Is there a way to make subrequests from within a Worker really bypass the Cloudflare cache (meaning: don’t have the response come into the Worker via the cache; the cache is not in the subrequest/response flow)?
I’m aware of cf: { cacheTtl: 0 } and that serves no purpose here.
I’ve read the responses of @harris in Disable cache on worker's subrequest and hope to receive some good news :wink:

If not, have any ideas for better ways tackle my challenge??