[omginternets]

>Stick with Go 1.7 means no security update.

As noted in the above comment, this isn't necessarily the case.

You might consider writing on the golang mailing list, explicitly asking them to backport security fixes to 1.7 in the future. I think this is a reasonable request, and one that is likely to be implemented if it garners even slight interest.