>Ain't using CVS potentially an issue here?

No, why would it? If you don't trust the openbsd developers, the don't use their code.