" I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct)"
This seems like a solution, right? People will ask why their stuff is breaking, and either drop Go for being unreliable or get google to fix it's behavior. Win/win