Kinda. If there's a versioned release at the same SHA, the next `go mod tidy` will replace it with the version.

And while the go.sum file in a module is returned by proxy.golang.org (somewhat surprisingly), that only includes the module's dependencies, not itself. So you're still stuck trusting a goproxy to serve you the correct data.