There is a CL started at https://codereview.chromium.org/2749873003/ for reference.
Whether font names should be quoted is still TBD.

I looked into this a bit more. If a font family name has spaces the name is quoted by the Polymer binding. If there are double quotes (") they are escaped with a backslash. If there are single quotes in the name the font-family style is removed.

Things I tried: using a font with a " in the name, a ' in the name, both " and ' to find some why to execute <script> from a name.

It's hard to say that it cannot be hacked (by escaping from the style with a font name), but the attempts I made didn't show any exploitation opportunities. 

Another note: Fonts have several names, there's the font file name, the fontname, font family name, and human readable name. We show the font family name in the UI, which is the one used in the style. So we won't show a name like MyFont where the font-family is ";content:'<script>...'", instead we'd show the name in the UI as ";content:'<script>...'" (which is a bit more secure in itself - the user would need to actively select a font with a very strange name - but even if they do, empirically the name will be escaped or blocked).

I'm ready to call this wontFix since it looks like no changes are needed, but is there more that should be tried?

Dan wdyt?