The scenario with unsigned URLs will most definitely work. I've successfully segmented video streams with ffmpeg onto S3 and served from CF. It's all HTTP after all.
If you wish to restrict access to your HLS content, your playlist file would need to include signed URLs as well. You would typically compute these as the playlist is requested, based on whatever credentials you wish to authenticate the user with. Thus, you need a server-side implementation that generates session-unique m3u8's for you in order for the signed-URL scheme to make sense.
Depending on your needs, another option would be to look into DRM. JW Player supports single/rotating key fragment decryption, which arguably tends to be a more complicated solution. You would then be left with the matter of securely distributing decryption keys to your clients.
I hope this somewhat addresses your concerns. If not, feel free to leave a comment.