Limit @font-face font local() fonts and disable local fallback rendering
Gk pointed out in https://trac.torproject.org/projects/tor/ticket/5273#comment:42 that the initial display font before the WebFont is loaded is the "best fallback CSS font on the user's computer" (from https://developer.mozilla.org/en-US/docs/CSS/@font-face).
My guess was that the chosen font will be the default system font for the specified style if we don't have that font family, but what if the WebFont has the same name as a font that is on the system? Do we exempt it and allow text to be rendered with that local font briefly? Or does Firefox decide not to download the WebFont in the first place, such that that rule will count as a font probe?
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information