The original problem was Go rather stupidlt pointing to a repo, instead of a specific commit on a repo. Normal github use at the very least would be to point to tags. Someone deleted their account, all those tags (which are empty commits) become invalid.

Because you're not building a list of just username and repo names for software dependent purposes, right? That would be a massive security failing on your part.