Hacker News Reader

Why .well_known/ instead of HTTP headers (possibly on a HEAD request beforehand, like CORS)?

To ensure the entire origin had the same policy. Perhaps that's unnecessary though.