To me the important part is "Starting with Firefox 58, the CSP of a web page does not apply to content inserted by an extension". This was flagged as going to b

To me the important part is "Starting with Firefox 58, the CSP of a web page does not apply to content inserted by an extension". This was flagged as going to be a problem back when CSP was still a draft instead of a spec, and it was blatantly obvious that bookmarklets and extensions would get impaired if CSP ignored the difference between site-content-activated scripts, and browser-owner-activated scripts. I would have preferred to see this land 6 to 12 weeks after CSP handling originally landed in Firefox, but landing it now is a clear case of "better late than never".