Q: How can you tell when a web font technology gone mainstream?

A: When a major security research company discovers that scumbags are now using it for their phishing campaigns! (https://www.siliconrepublic.com/enterprise/phishing-web-fonts-fake)

I must admit that using webfonts as a substitution cypher is a clever idea, and I can see some potentially good uses for it (imagine building a secure communication channel where a cypher is switched algorithmically by e.g. using different font style/weights), but it also begs another question to be asked - were we too optimistic when we declared DSIG to be of no significant importance for webfonts / WOFF2? And, do we need to update "Security considerations" section knowing that webfonts could be a much more treacherous grounds than we previously imagined?

Thanks,
Vlad