Support for specifying the font-src CSP directive has recently been added, see Fonts for details.
font-src