I’ve been working on this in secret with @Jmiller 
Really by DM.
I had to parse out style tag and content then readd after document was purified so we have that capability.
Also changed rendering to allow URL HTTPS requests for QR codes and base64 image data.
I’ve posted a fix here and will add to patch 3.
Files go into directory portal/lib
download_template.php (25.6 KB)
doc_lib.php (6.4 KB)
PDF from Dashboard(I added the red color style to test the style tag)
Privacypolicy_2.pdf (97.2 KB)