Bouncycastle has an entirely separate set of FIPS jars than non-FIPS, and those FIPS jars are signed and maybe encrypted? so that they can not be embedded into the uberjar.