What's the point of HMAC when you already authenticate with GCM?