Whitelisted @font-face provider, fonts still blocked

Let's say that I trust that Typekit will not serve malware fonts.

I have whitelisted typekit.com and typekit.net (The .net site seems to be their CDN or something.)

I go to a site that is new to me (example: http://schoolguide.co.uk/) and untrusted by default.

NoScript blocks loading the typekit fonts that are @font-face included by schoolguide.co.uk. (Turning off "Forbid @font-face" in the NoScript Options makes them appear.)

This seems wrong to me.

Is this the intended behavior? Or a bug? Or do I need to do something extra to make it work as I expect?

Thanks!