I have created a package manager for Go (as a wrapper around the original go command) to painlessly manage private dependencies. It uses an NPM like approach by tracking packages in a package.json file. This allows you to add go.mod and go.sum to .gitignore as anytime someone clones the repo they can be restored using the go-painless restore command.
You can find it at my Github. Feel free to contribute as well 
Not sure if this the right place to let other people know about this tool though!