As an example, webfonts can make rendered text differ from the underlying text that ends up on your clipboard.

Sure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code