CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.