Is it possible to specify source list values based on the script src. The RFC mentions it, but I'm not sure about its usage.
Content-Security-Policy:default-src *; script-src 'unsafe-inline' 'self'; Content-Security-Policy:script-src 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com/*';
This combination means to disallow
unsafe-eval everywhere except the Google Map APIs (which needs that).
If not then, it really means that apps have to remove
unsafe-eval for everything just because a service like Google Maps needs it. I'm not sure if nonces can be used for this type of situations.