Ended up “solving” the problem by hardcoding a minimum TTL of 3600 sec into the CDN for URLs outside /admin namespace and having TTL=0 for /admin
The CDN will then cache the content even if it has Pragma: no-cache.
But if somebody has a better solution, I would appreciate to hear about it 
This seems related to https://discourse.getgrav.org/t/how-to-set-cache-control-for-images/7285