The main idea is that smtpctl spf walk will read a list of domains from stdin and output a list of IP addresses and ranges to stdout, allowing it to be used in scripts, to generate file lists, or to be piped directly into pfctl to feed a table.
upobsd is a ksh(1) script designed to download, verify and optionally patch bsd.rd image.
upobsd will download bsd.rd image using ftp(1) from mirror defined in installurl(5), will verify the downloaded file using signify(1) and local key inside /etc/signify to ensure integrity, and optionally patch the image for adding auto_install.conf or auto_upgrade.conf file to add support of offline autoinstall(8).
Patching requires super-user privilegies in order to use vnconfig(8) and mount(8) for modifying the ramdisk image. doas(1) will be used for this purpose and should be configured accordingly.