We use PageBuilder on OBF to maintain our robots.txt and via a ticket we were able to have it served from the CDN root. It works well.
We'd like to extend this pattern to cover files like /.well-known/security.txt
Please add the ability to serve /arc/outboundfeeds/.well-known/ from the CDN root.
Note that we plan to also set up redirects in Delivery so things like /.well-known/change-password will redirect to our change password page.