I added 0.0.0.0 to the list of allowed domains in our Typekit kit settings, then allowed data: for fonts via Content Security Policy (CSP) headers.