Probably Yes
Tried again with Cloudflare and managed to add the ccTLD, even though it remains with another registrar. Not sure why it didn't work the other two times, third time lucky maybe. The "not supported" discussions on Cloudflare community site are probably related to domain transfer.
Since I have proven that it is possible to have a ccTLD not on their list as an "active site" on Clouflare, I conclude that it is likely possible that it will also work on CloudFront. I am no longer interested in trying it at this point.
Enabling DNSSEC through Cloudflare took a long time. It was stuck for several days on "DNSSEC is pending while we wait for the DS to be added to your registrar. This usually takes ten minutes, but can take up to an hour" even though I added the required DS record on the registrar. However, it was good eventually. Don't know how that would work in Cloudfront.
Side Note: Leaving this open in case it is useful to others. If
somebody can confirm this on CloudFront, I'll take it as the accepted
answer. If on the other hand, people feel that this question has no
value, please add a comment and I will (try to) delete this post
entirely. Thanks.