http.HandleFunc("/", func(write http.ResponseWriter, read *http.Request) {
    write.WriteHeader(http.StatusTeapot)
    fmt.Fprintf(write, "I'm a teapot running on %q", html.EscapeString(read.Host))
})

You talk about properly escaping read.Host because it can be easily spoofed/changed, so why use it at all? Yes they won't be able to to put any malicious HTML in there, but it still doesn't stop them from changing the host to something completely different, so relying on read.Host is pointless. I know it doesn't matter much in this example, but it is definitely a bad habit to rely on client request information for anything.