I've pushed a WIP branch for the first kick at a server implementation. The focus on this initial code is to show the uacp package changes that need to occur to support listening for unsolicited messages and how that integrates into both the client and the server code. I anticipate these changes being the first to be merged, then the server code can follow once it's fleshed out.
The primary difference is that I moved the goroutine read loop out of the uasc package and into each of the client and server packages. The uasc package still deals with decoding/decrypting the messages, but returns the service up to the application layer. The exception to this are the Open and Close SecureChannel requests; those are dealt with directly in the uasc package without notifying the client/server.

The server implementation has preliminary support for opening and closing secure channels, auto-builds endpoints, and opening/closing/activating sessions. Authorization has config for the purpose of endpoint generation, but is otherwise not implemented yet. The session management is still in a very early state and should be normalized with the client implementation (they're currently totally separate). Other services are just placeholders for now. To properly implement further services, the server needs to implement an address space, which is what I've started looking into next.