> Conservative would be one thing. Stubbornly out of date would be another. Indeed. Also often impractical. A way to solve this is to support both a regular m

> Conservative would be one thing. Stubbornly out of date would be another. Indeed. Also often impractical. A way to solve this is to support both a regular mode of operation and a FIPS mode of operation. I've worked on multiple enterprise products at different companies that take this approach. The full-on FIPS compliant mode is there to check all the boxes for customers who need that for their auditors. Even withing the set of those customers, a majority don't actually run the product in FIPS mode because it's too limited.