The io-pkt-v4-hc and io-pkt-v6-hc stack variants include full, built-in support for IPsec.
There's a good reference page in the NetBSD man pages covering IPsec in general. There are some aspects that don't apply (you obviously don't have to worry about rebuilding the kernel), but the general usage is the same.