It
looks like there's four update streams (at least):
- Sprint
- AT&T
- China
- Everyone else
It seems the differences between them are the boot and recovery signatures, since downloaded files include every radio and OEM file, but only include one signature pairing out of the four. The boot and recovery signatures are exactly 416 bytes put together, and it's those 416 bytes that keep the streams separated. If it weren't for those signatures (and some other logistical issues), one could put, say, the latest China KEYone OS on a non-China KEYone, with Google services, and the right radio, and the September 5, 2017 patch level.
However, even within the "everyone else" stream there's variation, since the KEYones sold in Canada don't get the same OS as the ones sold in Europe, and they might get the same OS as the ones sold in America but at a different time, et cetera et cetera et cetera.