hah, I forgot about that note.

Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all.

I've made an issue to move font/css hosting off Google.