You have to jump through much of the same hoops you describe, having a public `.well-known` endpoint for example. I have achieved this in the past by putting the OIDC discovery information in an S3 bucket.
The Hacker in hacker news was never meant to imply black hat/malicious types of hacking. There’s quite a difference between say, tearing something apart, reverse engineering it, breaking into something that _you_ own, versus trying to tear into something you don’t own without a really good reason. At the end of the day it’s about judgement and taste, there isn’t so much a hardline but there is a line on what we consider acceptable and unacceptable areas of exploitation. Beyond the piracy point, I think few could find this exploitative, it seems like a cool open source project that could genuinely offer better and customizable user experience.