Comment by fpoling

Go also includes a database of known package hashes so altering git tag to point to another commit will be detected.