Helping Github and Cloudflare Shake Hands
I am using Cloudflare DNS for my domain, and I did not know that there were additional steps I needed to take for the domain to work properly and have HTTPS enabled.
To pass the DNS check on GitHub’s side, disable proxying through Cloudflare.
From this:

To this:

If you not do this GitHub will yell at you with:
Domain’s DNS record could not be retrieved. For more information, see documentation (InvalidDNSError).
Add
CNAMEforwwwrecord.Otherwise, you will see this error:

Wait until GitHub Pages’s settings see new DNS records.
Check the “Enforce HTTPS” setting.
GitHub’s interface is very finicky so after you are sure everything looks good, close it and do not touch it anymore.
[!warning] Re-enabling Claudlfare proxying will cause certificate renewal to fail, so keep these DNS records “DNS Only”.
Troubleshooting
If after all this GitHub still is not happy, try switching Cloudflare’s TLS config from “Automatic” to “Full”.