I found docx to be a very well documented format and a surprisingly good fit for this.
https://tinycld.org has a live demo
I expect I could find whether you're using hardened server implementations or reimplementing, but if it's the former, you should advertise that, or if the latter, you shouldn't.
I do not know what you expect by "hardened server implementations", it's open-source and people will probably host it a lot of different ways? If you're talking about the various services it offers like imap/webdav, I'm using well established golang libraries which I hope are secure but I have not performed a security audit or anything like that.
"If you're talking about the various services it offers like imap/webdav, I'm using well established golang libraries"
That's exactly what I'd hope to see said somewhere as a naive person. Maybe security people would say "that's only 50% of the attack surface!!!" but I'm not one so it sounds good to me.