cd /tmp

pkg install unbound ca_root_nss
fetch https://raw.githubusercontent.com/HardenedBSD/hardenedBSD/hardened/12-stable/master/usr.sbin/hbsd-update/hbsd-update
fetch https://raw.githubusercontent.com/HardenedBSD/hardenedBSD/hardened/12-stable/master/usr.sbin/hbsd-update/hbsd-update.conf
sed -i -e '/^UNBOUND_HOST=/ s/\/usr\/sbin\/unbound-host/\/usr\/local\/sbin\/unbound-host/' hbsd-update
fetch https://raw.githubusercontent.com/HardenedBSD/hardenedBSD/hardened/12-stable/master/share/keys/hbsd-update/trusted/dnssec.key-2016-07-30
fetch https://raw.githubusercontent.com/HardenedBSD/hardenedBSD/hardened/12-stable/master/share/keys/hbsd-update/trusted/ca.hardenedbsd.org
mv hbsd-update /usr/sbin
chmod +x /usr/sbin/hbsd-update
mv hbsd-update.conf /etc
mkdir -p /usr/share/keys/hbsd-update/trusted
mv ca.hardenedbsd.org /usr/share/keys/hbsd-update/trusted
mv dnssec.key-2016-07-30 /usr/share/keys/hbsd-update/trusted
ln -s /usr/share/keys/hbsd-update/trusted/ca.hardenedbsd.org /usr/share/keys/hbsd-update/trusted/5905e1b4.0
ln -s /usr/share/keys/hbsd-update/trusted/dnssec.key-2016-07-30 /usr/share/keys/hbsd-update/trusted/dnssec.key
hbsd-update && reboot