People do change what a particular version is of a Go module

That is tricky. I wonder how other package systems handle this.

I do think I prefer having the version being "immutable" (as enforced by the proxy, anyway) over alternatives since it's safer.

Maybe the Go proxy should periodically rescan the source and print warning messages on go get if they don't match up?