(Yeesh your site connects to a lot of hosts...)

This is about HTTP/2 connection reuse, despite the title. I did my own run of it here, but this time had it capture the NetLog and it does reproduce this.
https://www.webpagetest.org/result/180606_TH_09ee8a18c06e28515dc12a93050dc2d1/

Specifically this is caused by https://venom-assets.edmunds-media.com/edmunds-icons.d6c6f44127d52a92cde986b1cbc4bcd9.woff2 being uncredentialed and we split credentialed connections from uncredentialed ones.

+rsleevi, I don't know if there is an existing bug to dup this into. This is something we're evaluating, but there's a long path of things to change or sort out before we get there, if we decide to.

Hi David,
what does it mean that https://venom-assets.edmunds-media.com/edmunds-icons.d6c6f44127d52a92cde986b1cbc4bcd9.woff2 is uncredentialed?
I verified the host has a valid certificate - https://www.ssllabs.com/ssltest/analyze.html?d=venom-assets.edmunds-media.com

Also this issue does not seem to happen on IE11 - https://www.webpagetest.org/result/180606_YW_0c71277091e71d5d9676ee146f0e6eb2/3/details/#waterfall_view_step1 

Or Firefox - https://www.webpagetest.org/result/180606_39_b3c30d741531113c6e2f700f5ab30f0d/1/details/#waterfall_view_step1

Uncredentialed meaning sent without cookies and such (CORS anonymous).

I don't know whether other browsers shard that way. Our history here is a little funny.

Got it. Would it help if we put the font request on the same origin (www.edmunds.com)?

Also, at the risk of digressing a bit but since you mentioned that we connect to a lot of hosts... 
are there any optimizations you can suggest, wrt to hosts, subdomains or number of requests?

So the 'with credentials' aspect is presently spec'ced as https://drafts.csswg.org/css-fonts/#font-fetching-requirements - namely, that it requires the font fetch be made with CORS Anonymous mode. "When fetching, user agents must use "Anonymous" mode,"

This triggers a separate socket connection. This is documented in https://fetch.spec.whatwg.org/#connections . Changing that is being tracked in https://github.com/whatwg/fetch/issues/341

Changing it to be same-origin will not change that behaviour. You could use preconnect to preconnect in anonymous mode.

As David mentioned, we're exploring the possibility of changing that, both in Fetch and implementation, but that's a rather substantial change, and it's blocked on other rather substantial changes, such as Issue 799935.

Tagging this as a P-3/Feature request, since it'll also require the spec change