… do you think special-casing Permalinks under /.well-known/ to work regardless of login-required might be a good idea?
This trick is a super simple way of getting this kind of verification working for site owners, and it would be great if we could make it work in all scenarios.