The bigger problem is that in go you can not do privilege revocation. And although unprivileged binding <=1023 has been a solved problem for well over a decade, most people still consider it a dark art.
So they go for a reverse proxy, more often than not, just to get the 80/443 binding.
Yes, and it works good with Go since you have static executables so you do not have to set the capability on an interpreter. But you have to reapply it after every upgrade, which is easy enough to automate. That said, I mostly use mac_portacl on FreeBSD.
So they go for a reverse proxy, more often than not, just to get the 80/443 binding.