The fonttools subsetter has an option for obfuscating names to make web fonts unusable as system fonts without modification.

This only targets specific standard names, with font-specific names (IDs 256+) left alone:

When building dependent tables such as fvar and STAT, however, fonttools will seek to reuse existing name records: for example, an fvar instance named Regular may reuse the 'Font Subfamily' name (ID 2) instead of creating an identical but font-specific entry (ID 256+) in order to save space.

This is desirable and spec-compliant, but as a side-effect means that later fonttools scrambling will reach outside of the name entry into any fvar and STAT entries that reused the name ID, and scramble their names too as an unintended consequence.

Where this happens, should we make duplicates in the font-specific area (ID 256+) and redirect other tables to them, or are we confident that none of these name IDs are exposed in the environments in which names may wish to be obfuscated (e.g. browsers)?