1. No—you can set this directly from App Services.
2. No—you can attach all kinds of SSL certificates to Azure App Services, regardless of where they come from.
3. No—system-assigned managed identities can only be assigned to the scope of the Azure resource where they are created.