The wizardry is server side. See the css. You won't get the same hash. When called one time + ip + client browser hash, it is enough. Next website visited with a google font, you are tracked.
/* latin */ @font-face { font-family: 'Tangerine'; font-style: normal; font-weight: 400; src: local('Tangerine Regular'), local('Tangerine-Regular'), url(https://fonts.gstatic.com/s/tangerine/v9/IurY6Y5j_oScZZ784Ox...) format('woff2'); unicode-range: U+0000-(...) }