Another aspect is that security software has additional requirements that most other software doesn't, and that can be a problem. My impression is that the crypto community generally regards the Go crypto stack as fairly algorithmically solid, but it hasn't necessarily been hammered on to the n'th degree for things like timing attacks. I'm comfortable using it in my usecases, but I'd be a bit nervous about deploying it to my high-security stuff. Things like reaching out to the network for crypto keys is also a convenient feature in some ways but something I'd want to see much,
much hardened compared to what I might ask of a non-security program doing something similar.
That said, I don't say this to discourage the project. I wish it all the best and hope that they continue to work out the issues involved. I'm speaking more here to dampen the set of programmers and/or ops I know who will read something like this and immediately begin converting their entire fleet, because this looks new and hot and uses $TECH I like and must therefore be better than the old and busted using $BADTECH I don't like. Hey, I'm on the cutting edge of hating C and thinking almost anything written in it should be banned from the network, but OpenSSH does have a pretty good track record and that shouldn't be chucked overboard for new untested hotness.
Best wishes to Caddy-SSH. I would encourage a bit of trying it out, just, you know, don't go crazy. I don't think they'd want you to either!