I understand FreeBSD 4-stable has TCP MD5 signatures, with OCF offload hooks. I had just started to look at backporting that when the NetBSD 2.0 release engineering team precipitously announced a rushed release schedule. I'll add the code sometime after NetBSD 2.0 -- unless someone beats me to it.