Review proposed Golang ecosystem changes

[mkonda]

https://go.googlesource.com/proposal/+/master/design/25530-sumdb.md

[mkonda]

golang/go#25530

[mkonda]

Specific comments:

1. The go.sum concept is useful in
2. The go distributed source ecosystem (eg. github repos) is usefully decentralized.

But:

1. I don't see any clear authentication of developers
2. I don't see a security alerting mechanism
3. No MFA
4. No security alerting process

Basically none of the Tier 2 items we are talking about are really addressed in this proposal.

[mkonda]

golang/go#25530