https://go.dev/dl/

https://www.postgresql.org/ftp/source/v15.0/

As counter examples, both the Linux kernel and rust sign downloads they publish:

https://kernel.org/

https://forge.rust-lang.org/infra/other-installation-methods.html#source-code

What is the reason that Google and Postgres have for not signing software downloads? MD5 and SHA256 checksums do not verify the authenticity of the downloaded software.