I tested a /.well-known in a theme on Ghost(Pro), and it worked! So maybe no middleware needed after all? The only thing I did not test was whether the content-type was correct in the response headers.