PS: I'm also against a hashlib.fips module in stdlib. FIPS mode is irrelevant for majority of users and countries. I neither want to confuse people nor introduce more maintenance and documentation burden than necessary. Antoine gave another good reason against a fips module, too.

I'm fine with a used_for_security flag and functions to get/set FIPS state. Something like hashlib.get_fips_mode() is useful for testing.