> I really do wish they baked a SHA into the go.mod (not just go.sum) so you could find a library and get a known-good download from any proxy with any name.

You already can use SHA in go.mod in exactly the same way you would use a version string.

I don’t know about using multiple proxies in go mod though.

Kinda. If there's a versioned release at the same SHA, the next `go mod tidy` will replace it with the version.

And while the go.sum file in a module is returned by proxy.golang.org (somewhat surprisingly), that only includes the module's dependencies, not itself. So you're still stuck trusting a goproxy to serve you the correct data.