meta/csp.yml declares connect-src.wss and worker-src.blob under flags, which renders them as the quoted keywords 'wss' and 'blob'. The browser console of every page reports The source list for the Content Security Policy directive 'connect-src' contains an invalid source: ''wss''. It will be ignored. and the same for 'blob' in worker-src, and in a conference Creating a worker from 'blob:https://meet.<domain>/…' violates the following Content Security Policy directive: "worker-src 'self' 'blob'", followed by an e2ee:E2EEContext worker error (measured on the compose stack with sso disabled). Cause: flags are for keyword sources such as unsafe-inline, scheme sources need their colon. Options: declare both as whitelist entries ("wss:" under connect-src, "blob:" under worker-src), as roles/web-app-nextcloud/meta/csp.yml does for blob:.
