FedRAMP policies have been relaxed, and they allow using newer compilers: https://github.com/google/boringssl/blob/main/crypto/fipsmodule/FIPS.md#update-stream