You're supposed to check the digital signature after downloading the install image. Other than that, it's the same as Linux. Windows has a lot of "unknown stuff too", but you can actually research the source code for OpenBSD if you're worried.