That /.well-known/change-password redirection is very clever. Easy to implement, and could automate a lot of things (good or bad, obviously it relies on your password change strategy to be good [0]).
I've only discovered (ironically) the .well-known scoped routes with LetsEncrypt, and more recently with Keybase's validation [1] and security.txt [2], is there a global registry that lists initiatives that make use of this route ?
[0] https://www.troyhunt.com/everything-you-ever-wanted-to-know/ (warning, some NSFW content)