Right now vendor directories in a go module don't really work as expected (or at all depending on the situation).

They should work seamlessly and enable the removal off all deps on the internet in terms of go modules and use of private packages the engine may not be able to access.