I'm really not crazy about the "import github.com/foobar/foo" thing. It seems that systems like CPAN have an advantage in that a) you can roll your own mirror to avoid using an untrusted network and b) should upstream change their VCS etc, the go system requires changes to all files that import the affected module. The go system also seems to ignore the problem of versioning libraries, though I imagine there's probab…
If you want to roll your own mirror simply change github.com/foo to my mirror.com/foo in your code. At least then you document the expected dependency with the code itself and can remove it if required. It also lets you very easily import a local package instead if you prefer. If the maintainer changes the location of their package and you have not taken a copy you might have to change your code, but this happens very rarely in my experience and isn't a big issue.
Go doesn't have versioning for packages yet, and they will need to add this, but that wouldn't be hard to add as an option to the current import scheme.