I usually prefer to whitelist domains rather than individual scripts. Either I trust a domain enough to serve scripts or I don't, there's rarely a middle ground.