NS records on subdomains in Cloudflare

It’s working fine. There are numerous Let’s Encrypt users here who can testify that it’s working perfectly.

Note that not every hostname is serving a website. https://smtp.gmail.com is also “not working” as a website but working perfectly fine for sending email.

Yes, they do. You can delegate subdomains to third party nameservers. This is what we do with acme.infinityfree.net. infinityfree.net is hosted on Cloudflare but acme.infinfinityfree.net is hosted on Amazon. This works fine in Cloudflare.

We’re not on a free account but I see no reason to believe that this would not work on a free account. It’s just basic DNS management. Cloudflare doesn’t limit that for anyone.