Has it been independently audited at all? I looked around and didn't find anything about it.
It's probably maybe fine, and of course code can change at any time, but with software focused on security, it would seem more necessary than, say, an audio player (excluding improbable situations).
Either way, It's nice to see a GPG alt written in Go.