go: sanity checks for hash lengths