[christophilus]

What bothers me most about it is the lack of a checksum, which is something Go modules support. I think that’s a mandatory feature to prevent certain attack vectors. Other than that, I have no problem with this approach.

[piscisaureus]

Package validation (using a checksum or signature) is definitely on our radar. We just haven't gotten around to it yet.