If I understand https://www.rfc-editor.org/rfc/rfc7033#section-3.1 correctly, a service can take an email and just craft the well-known URL from the domain. It doesn't matter what's hosted where. I was working on getting Tailscale to authenticate against Cloudron's OIDC (https://tailscale.com/kb/1240/sso-custom-oidc).
The email for my domain is hosted at Fastmail, but the website is on Cloudron. I was able to set up a quick LAMP app at the root domain on Cloudron and have it respond to the webfinger request. Tailscale then picked it up and allowed me to authenticate properly.
Having it in the well-known-locations dialog would certainly have been easier.