People using Go modules should be using git tags, right? They should have at least one hash already that should be infinitely cacheable, the tag commit. Of cou

People using Go modules should be using git tags, right? They should have at least one hash already that should be infinitely cacheable, the tag commit. Of course, I have seen alleged examples of Go modules using tags like branches and force pushing them regularly, but that kind of horror sends shivers down my back, at least, and I don't understand why you'd build an ecosystem supporting that sort of nonsense and which needs to be this paranoid and do full repository clones just for caching tag contents. If anything: lock it down more by requiring tag signatures and throwing errors if a signed tag ever changes. So much of what I read about the Go module ecosystem sounds to me like they want supply chain failures. I don't understand the Go ecosystem.