Post Go 1.13.x update, with GOPROXY set to Artifactory, not all go related requests will go to Artifactory. The gosumdb requests (supported, lookup, tile) will go directly to Google's gosumdb.
One of the possible solutions is to enable gosumdb support and in addition maybe to suggest GOPRIVATE regex (for private modules).
Why this is important?
Artifactory should be the source of truth in both online and offline setup not only for packages but also the checksum metadata related to the packages.