Building for FIPS compliance

[srfraser]

Having read through #409 #1320 and related, it seems that FIPS mode is supported if compiled with the appropriate libraries, although no container images are published for it. It seems the two options are:

1. Google's dev.boringcrypto branch, which states "To be clear, we are not making any statements or representations about the suitability of this code in relation to the FIPS 140-2 standard." here, although it appears that go.14 builds based on 24e5886c0edfc409c8083d10f9f1120111efd6f5 are validated until July 2022.
2. RedHat's work on top of Boring, but not being a RedHat customer I can't access the container images needed to use it

What's the recommended approach to building a FIPS compliant version of the notary server and signer?