go.mod keeps checksums, so this should come up easily for downstream consumers. However, when devs change dependencies, an innocent `go mod …` might update to

go.mod keeps checksums, so this should come up easily for downstream consumers. However, when devs change dependencies, an innocent `go mod …` might update to a new (compromised) version of a dependency.