Well - sure, but we can't change the history, and GCM is the mode that got picked by NIST, is most widely implemented, and is used in lots of places. It has bee

Well - sure, but we can't change the history, and GCM is the mode that got picked by NIST, is most widely implemented, and is used in lots of places. It has been widely analyzed and scrutinized, and is unlikely to turn out to be insecure at this point. I personally actually also agree that having a single mode would've been more elegant, but sometimes, in a collaborative open standard, compromises are necessary for practical or political reasons. Some people care about FIPS compliance, others care about performance, and so on. If you have a benevolent dictator, you can just tell (some of) those people to go away, but that's not really how an IETF working group works - the goal there is (rough) consensus. And, personally I don't think any of these compromises are so unreasonable as to call for fearmongering and references to the NSA. Again, GCM is used securely in lots of places, there's no reason it can't be used securely in OpenPGP too.