This problem is an interesting case of Zooko's triangle trilemma.
Zooko theorized that in any name system, you can have any two of the following, but not all three:
Human-meaningful names - i.e. names like nytimes.com instead of nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion
Secure - i.e. a bad actor cannot impersonate someone else
Decentralized - i.e. no need for a centralized authority like a CA.
So, you could get 2 and 3, by giving up 1. In other words, instead of the project being named 'golang', it might be named '6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be'. And, instead of your friend saying 'golang is cool, try it out', your friend would say '6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be is cool, try it out'.
The reason this works is that
6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be is not only a name, but also a public key. The project authors sign all of their documentation using the private key that corresponds with the public key
So, when you arrive at the documentation for
6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be, you can verify that it is in fact the true and correct documentation for
6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be, using the public key
6bbe074425f1f10512f9db02d6c1d28fbe8845b65575ed151dcee953a0f969be to verify the signature.
Not very user-friendly, but it meets your objective of a 'zero-trust identification of an origin'. This is how systems like bitcoin and tor hidden services are secured, without the need for any central authority.