I hope by now everyone recognizes that CLAs are bullshit and you should refuse with one.
In fact a fun game to play right now as an open source community would be to find projects with CLAs and make a bunch of legit pull requests but refuse to sign a CLA. Bury their repo in small contributions that they can't merge.