I verified that the hashes of the new .zip and .mod files match those in a trusted go.sum file. They do.

I wasn't worried since I copied them from my local cache ($GOPATH/pkg/mod/cache/download), but it was nice to see all the pieces come together.

All this can be automated. pic.twitter.com/CCSgFPPBn6

— Dmitri Shuralyov (@dmitshur) May 4, 2019