Universal Links: Source countries or IP ranges used to retrieve AASA file

I’m looking for clarification on how Apple retrieves the apple-app-site-association (AASA) file for Universal Links / Associated Domains.

Assume a domain exposes the AASA file at: https://example.com/.well-known/apple-app-site-association

The domain is protected by Geo-Blocking, where access from certain countries/regions is restricted.

I would like to understand the expected network behavior for AASA retrieval:

1. Can requests to retrieve the AASA file originate from Apple infrastructure in different countries or regions globally?
2. Does Apple publish a list of source countries, IP addresses, IP ranges, or network ranges specifically used for AASA retrieval?
3. Can the source country or IP address change over time due to Apple's infrastructure, CDN, or routing?
4. Is there any supported way to force AASA retrieval through a particular region, such as the US?
5. If certain countries are blocked, is there any way to determine whether Apple may use infrastructure from those countries for AASA retrieval?
6. Is the recommended approach to allow the following endpoint to be publicly reachable regardless of source geography?

The objective is to restrict access as much as possible while ensuring that Universal Links continue to work reliably.

If there is any official Apple documentation covering the source network, IP ranges, geographic locations, or accessibility requirements for AASA retrieval, a reference would be greatly appreciated.