With Tink you can use BoringSSLs BoringCrypto as a FIPS 140-2 validated backend. For further details see Use Tink to meet FIPS 140-2 security requirements.