Why re-sign? I don't think signature includes the origin in the string, just region, time and key.
For multipart, the state is already maintained on the cloudflare side, why again?
Just making a proxy shouldn't have any complications. But i have never tried it before, so let me know if I am wrong, seems like a decent way to hide the account id if someone wants