Do CSP headers change dynamically between page loads very often? I can't think of a situation where that would happen. Consequently rebuilding them with PHP seems unnecessary. Writing them using a build tool (eg gulp), and saving them to a static includable file (or even a server config include) would get you the same benefits without adding load to the page on every request.

Take said, this is still far better than not having a CSP or having a static one, so it's an admirable project regardless.