There's a difference between trusting Go without reading its source (no dependencies other than the previous version of Go and maybe a C compiler if you want to bootstrap it from version 1.4, run in production at big tech companies, actively maintained by Google) and trusting Hugo (1200 deps, huge plugin ecosystem with less battle-tested packages, unaudited templates that could inject anything they want into your site unless you read each release carefully).
Golang is "only" 2 million lines of code, and it's quite easy to go look at the implementation of something, as the docs link directly to the code. It wouldn't be impossible to read through it, particularly if you skipped architectures other than x86 and parts of the standard library you didn't use.
Getting really familiar reading the golang source code is a great way to understand how to write better go code. It's one of the thing I recommend to new programmmers in this language all the time because it's so accessible from a properly configured editor which will actually go to the definition in the standard lib at the whim of a couple of keystrokes.
Golang is "only" 2 million lines of code, and it's quite easy to go look at the implementation of something, as the docs link directly to the code. It wouldn't be impossible to read through it, particularly if you skipped architectures other than x86 and parts of the standard library you didn't use.