fips2go runs a FIPS mesh node on your phone and hands it to the apps you
pick, over a per-app VPN tunnel. Selected apps reach .fips names on the
mesh and keep normal internet; every other app on the device is
untouched.

Per-app split tunnel. You choose which apps join the mesh. They get the
mesh and clearnet at once; nothing else on the phone is affected. With no
apps selected the tunnel does nothing.
.fips names just resolve. DNS for covered apps is answered in-process
for .fips, and forwarded to your normal resolvers for everything else.
Default-deny inbound firewall. Other mesh nodes cannot reach ports your
apps listen on. Only replies to connections you opened, ICMPv6, and an
explicit port allowlist get through.
Identity sealed by the Android Keystore, with backup and restore so it
survives a reinstall.
FIPS Hotspot. Auto-joins open Wi-Fi named !FIPS to reach nearby
peers, while your internet stays on your normal network.
LAN discovery (mDNS). Finds peers on your Wi-Fi and dials them
directly, with no relay hop.
Survives network changes. A Wi-Fi to cellular hand-over keeps every
session and route; peers are re-pinned within a second, no reconnect.
Diagnostics. Resolve or ping an npub, inspect live peer sessions, and
read the node log.

Open source (MIT), no accounts, no telemetry. Requires Android 8.0 or later.