Running third-party ads on a site with a strict CSP (without weakening the CSP)

My static site had a deliberately tight Content-Security-Policy: default-src 'self', a short...