de Raadt is a remnant of the "real men" programming era. The upside of "real men" is that they write code, but then of course some Rust proponents write code too, and their code is in fact safer because to err is human.
There's an ACME (e.g. for Let's Encrypt) client included in OpenBSD which is exactly what you'd expect a real man ACME client to look like. It uses OpenBSD-only pledge() and similar features to do privilege separation, it has guards and checks throughout and so long as there aren't any missing (but there's no way to verify...) it's probably safe to use it - but it's written in C rather than a safer language.
There are some obvious security considerations you'd put in an ACME client, and somebody who thought OpenBSD was about security would probably expect them. But they are absent because it's not about security it's about being a real man. Examples: Using CSRs is safer as now the ACME client doesn't know your private keys, but acme-client doesn't provide any way to do that. Using the dns-01 challenge rather than http-01 or tls-alpn-01 allows you to do issuance from a system that isn't accessible from the outside world rather than having to open ports but acme-client only supports http-01 challenges.
There's an ACME (e.g. for Let's Encrypt) client included in OpenBSD which is exactly what you'd expect a real man ACME client to look like. It uses OpenBSD-only pledge() and similar features to do privilege separation, it has guards and checks throughout and so long as there aren't any missing (but there's no way to verify...) it's probably safe to use it - but it's written in C rather than a safer language.
There are some obvious security considerations you'd put in an ACME client, and somebody who thought OpenBSD was about security would probably expect them. But they are absent because it's not about security it's about being a real man. Examples: Using CSRs is safer as now the ACME client doesn't know your private keys, but acme-client doesn't provide any way to do that. Using the dns-01 challenge rather than http-01 or tls-alpn-01 allows you to do issuance from a system that isn't accessible from the outside world rather than having to open ports but acme-client only supports http-01 challenges.