Styles need unsafe-inline as I can't figure out how to add a nonce to
the actual script that gets injected in the script that loads google
fonts. Alas.