No domain verification is required at this point. Content-Security-Policies are ideally delivered through the HTTP response headers and then enforced by the browser. We are working on making the integration as easy and smooth as possible.