What is the issue with the HTML Standard?
Relates to: https://html.spec.whatwg.org/multipage/semantics.html#pragma-directives:attr-meta-http-equiv-keyword-content-security-policy
The policy's self origin is not set, which prevents the use of 'self' for policies created via meta elements. However, it is permissible to use 'self' here, for example with this WPT test: https://wpt.live/content-security-policy/connect-src/connect-src-beacon-blocked.sub.html
I believe there should be a step that states something along the lines of: