Implementing an AES-128-GCM authenticated encryption layer on top of MAVLink v2 — encrypting only the payload, with the nonce and tag required for decryption appended at the frame end (after the signature). The CRC does not cover them, adding 28 bytes in total. Includes the pymavlink generator, full integration steps for PX4 and QGroundControl, and a record of pitfalls.