[creata]

There's probably something horrific you can do with TrueType to make it more complex than a substitution cipher.

[lifthrasiir]

GSUB rules are inherently local, so for example the same cryptanalysis approach should work for space-separated words instead of letters. A polyalphabetic cipher would work better but that means you can't ever share the same internal glyph for visually same but differently encoded letters.

[cookiengineer]

The hint I want to give you is: unicode and ligatures :) they're awesome in the worst sense. Words can be ligatures, too, btw.