The easiest solution is to use the default font. This has the additional benefit of being the most legible font for every reader, because it's the one they have the most experience reading.

remember the times when common sense was to not accept the remote site's fonts, and thus web devs should not use them

Yes. I recommend everybody to do a deep dive into font file formats and you'll see a lot of monsters hiding.

That definitely deserves better tooling!