With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one.
A patch is available, all users of goxmldsig should upgrade to v1.1.0.
If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig