To be FIPS compliant we need to avoid OCB in the protection of private key files.

• We need an option for fips compliance in gpg-agent (or better common.conf)
• Use GCM with a fully random IV and PKKDF2

We already support two schemes (the old MDC style one and the OCB). We may want to rework the code to make it better extensible.