This addresses the biggest holdout I had so far: verifying that tagged releases don't change from underneath you, by checking against a Certificate Transparency-like local log of all encountered module versions and their hash.<p>As I understand it, go verify checks the local go.modverify file against all transitive dependencies. It might be valuable to also check those against the dependencies' go.modverify files as well (if present), to make sure everyone is on the same page on what each version represents.