Go does even better: every version+hash is checked into an immutable append-only transparency log that not even Google can tamper with undetectably.

If you change the contents of a git tag, it will just be rejected. No override, excuses or not.

Really every git-tag based system should do this.

Ah, no hashtags. How peculiar.