The download comes from dl.google.com while the checksum is published on golang.org.

FWIW the macOS pkg you download is signed.