Compatibility with Content Security Policy without 'unsafe-eval'? #162

I tried to use solid-auth-client.bundle.js to add solid to an existing website that uses Content Security Policy and ran into the error:
EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: ...

Obviously the error can be avoided by setting unsafe-eval, but it would be great if this wasn't necessary.

It appears the error is due to Function constructor calls in solid-auth-client dependencies.
The ones I found are:

@trust/json-document, which it appears is a dependency of @solid/oidc-rp both directly and indirectly via @solid/jose.
https://github.com/anvilresearch/json-document/blob/c2be5e377ebfda753ec9753d5107557617e08b64/src/Validator.js#L64
https://github.com/anvilresearch/json-document/blob/c2be5e377ebfda753ec9753d5107557617e08b64/src/Initializer.js#L34

In the webpack build of browser/index.js:

        // This works if eval is allowed (see CSP)
        g = g || new Function("return this")();

It appears this is a webpack configuration issue somewhere, requiring a node:false setting?
https://stackoverflow.com/questions/48695579/how-to-remove-eval-and-function-constructor-from-webpack-build-to-avoid-csp-issu

Fixing this is a bit out of my depth but I thought I'd share what I discovered so far...