It's unfortunately complicated to put a web font in a chrome packaged app, unfortunately:
https://stackoverflow.com/questions/19210451/packaging-a-font-with-a-google-chrome-extension

At the same time, this is in the common demo that isn't tied to being a chrome packaged app, right?

Either way seems fine. The CSP warning doesn't seem like the end of the world, and is something I hope google will eventually allow as a 'this is a static resource that i'd like you to keep cached for offline use'