Access to JKWS public key over public internet or HSCN?

Its all in the title … but if I use the option that I host the JKWS public key has that URL got be a accessible from the public facing internet or can it be restricted to just over HSCN?

Basically where does the request have to be accessible from?

To my knowledge, its up to APIs you may utilize.

I am looking for the partnership with NHS Trust.
Please let me know if that would work to you.