Personally I would recommend against removing a valuable font entirely
simply on the grounds that we don't have an editable-enough form
of it when the form we have is precisely what people actually *have*
been editing.
Sources for Cardo *do* exist at
https://github.com/googlefonts/CardoFont/tree/main/sources
but file names and repo history suggest they were created using the
"non source" files already present in Debian as their source.
Similarly, there's a derivative TeX font on CTAN
(https://ctan.org/tex-archive/fonts/fbb) with no obvious
indication that its author had access to more "source" than
Debian currently ships.
Even Debian itself was formerly applying patches directly to the .TTF
file (bug #1128206).
Regards,
Timothy Gaskell