Thanks for the reply.
I just checked in more detail.
The issues coming up are mainly based on inline scripts and inline styles.

"Refused to apply inline style" and "Refused to execute inline script".

To be sure I just tested with the 18.0.0 version of keycloak. But still, the directive cannot be used.

Since we are talking about an security relevant part of an architecture, this is something that should be addressed and fixed.

Inline scripts are implicitly blocked by the self policy since it explicitly requires the scripts to be downloaded from the server as separate files. Fixing this in the code would be ideal (I would also prefer it), but impossible depending on how the framework used by the interface generates the pages.

A possible workaround would be adding the unsafe-inline or a nonce value to the script-src, but it may not be acceptable for everyone.

There also seems to be an issue with styling, so similar options should be set for style-src. In this case, I believe separating styling and moving it to other files is harder, since frameworks may prefer adding styles inline with the HTML element. Something like <div style="display: none" to hide elements, for example.