[tptacek]

They're not wrong, and the limited nonce space in standard GCM is one of the most common problems cryptography engineers have with GCM.