Would the rootlesskit project consider checking in vendored go dependencies using https://go.dev/ref/mod#vendoring?
If so would you accept a PR to add this?