Update: Looks like I got caught up in a correlation that was not in fact the cause of the problem. Problem was actually an unrelated issue in how CSS files were deployed. See my answer below for details.
I have @font-face working well in WebKit (Safari and Chrome) and Opera, but not in Firefox 3.5 or IE 8.
Per recommendations by Google and others, I serve all static assets, including CSS, from a separate domain from my main site. If I serve everything from the same domain, it works fine in all browsers (note: this means that answers about CSS syntax are useless. I already have all of that figured out and working great. This is ONLY about the cross-domain issues).
If I serve CSS and font files from my static assets domain, and have the static assets server set the appropriate access-control header (Access-Control-Allow-Origin), which should work, it works everywhere except FF 3.5 and IE.
What do I need to do to make this work?