Use font tags, whitelist the used font tags

`style` is hard to validate, so I switched it to use font tags. And actually whitelist the stuff it generates FailFish.