Security review requested for CSS Fonts 4

Hi there,

CSS Working Group requests Security review of CSS Fonts 4.
<https://drafts.csswg.org/css-fonts-4/  <https://drafts.csswg.org/css-color-4/>>

This specification is used to allow different fonts to beused to display
Web pages, to control typographic features (how those fonts are used)
and to download fonts on demand (Web Fonts).
It builds on existing capabilities in CSS1, CSS2, and CSS Fonts 3,
which are all W3C Recommendations.
The main new additions are support for Variable Fonts and for
Color Fonts.

The responses to the Self-Review Questionnaire: Security and Privacy
<https://www.w3.org/TR/security-privacy-questionnaire/  <https://www.w3.org/TR/security-privacy-questionnaire/>> can be found on 
the specification:
<https://drafts.csswg.org/css-fonts-4/#priv-sec  <https://drafts.csswg.org/css-fonts-4/#priv-sec>>

We would prefer responses and discussion to happen on GitHub:
<https://github.com/w3c/csswg-drafts/issues  <https://github.com/w3c/csswg-drafts/issues>>

The specification at Working Draft; it is largely complete, and major
portions are stable and are seeing very active implementation. Our
anticipated timeframe to move to Candidate Recommendation is three to
six months, depending on how long it takes to close off remaining
issues of course. Meanwhile we are starting wide review in hope of
getting any major issues addressed before we publish an updated WD for a
stable Wide Review draft.

Thanks for your consideration.

-- 
Chris Lilley
@svgeesus
Technical Director @ W3C
W3C Strategy Team, Core Web Design
W3C Architecture & Technology Team, Core Web & Media