I shouldn’t need separate extensions to each block css, JavaScript, fonts, cookies, pixels, etc.
Remote fonts can be used for tracking and fingerprinting (hence why private browsing modes aren’t private).
Am I missing something here?
Isn't it the reverse, local fonts can be used for fingerprinting?
(There are some snags with remote fonts — rendering bugs/exploits — but they're not exactly low hanging fruit anymore)
EDIT: I see what you mean by tracking. If the fonts are loaded with a third party script, this is indeed a problem. If the font files are served by a third party directly (without some intermediate script), this could be remedied with an extension that strips headers. It would obviously run afoul of this only do one thing rule from Google, the company that once attached Google+ to its search results.
It wouldn’t surprise me if it were a hidden vector of some sort, but I haven’t put effort into digging into it.