> Remote fonts can be used for tracking and fingerprinting

Isn't it the reverse, local fonts can be used for fingerprinting?

(There are some snags with remote fonts — rendering bugs/exploits — but they're not exactly low hanging fruit anymore)

EDIT: I see what you mean by tracking. If the fonts are loaded with a third party script, this is indeed a problem. If the font files are served by a third party directly (without some intermediate script), this could be remedied with an extension that strips headers. It would obviously run afoul of this only do one thing rule from Google, the company that once attached Google+ to its search results.