Earlier quoted context omitted.
The bigger problem is that in go you can not do privilege revocation. And although unprivileged binding So they go for a reverse proxy, more often than not, just to get the 80/443 binding.
Is setcap(8) the informed thing to be using on Linux?
Yes, and it works good with Go since you have static executables so you do not have to set the capability on an interpreter. But you have to reapply it after every upgrade, which is easy enough to automate. That said, I mostly use mac_portacl on FreeBSD.