> I'm also unsure of what is going to happen over time as dependencies may be moved or removed

That's what the Go module proxy is for. The authors can move or remove their repositories as much as they want, I as a dependent am not bothered by it. They would have to go through an official vetted process to get it removed from the proxy.