Following the discussion here: https://groups.google.com/forum/?nomobile=true#!topic/golang-dev/jP0vjXdCj2s and here: https://github.com/golang/go/issues/14395 the plugin should provide an inspection for imports of `crypto/{des,md5,rc4,sha1}` into the current package. The type should be WEAK_WARNING and it should be enabled by default.