CSP content security policy installed, works well but I get messages refusing to load fonts

I thought data:application/octet-stream;base64 was just for images. Anyway, try adding this line:

<value id="self" type="host">data:</value>

It’s just a bit of a guess, as I don’t have a way to test this. I just pieced this together with a bit of Googling.