@this.josh I made a constant-time AES-CTR implementation that uses only plain 32-bit registers and is about three to four times slower than a classic, table-based implementations (i.e. I still get almost 50 MB/s on a 2.7 GHz i7). I think I can add the GCM part with relatively small overhead on that.
