CSP will have to be done through HTTP for now. Maybe at some point we'll add a feature for workers in general