At some time in the near future, IPsec will be required in GENERIC
kernels even if it affects packet forwarding performance.  I would
suggest GENERIC and GENERIC_LAPTOP uniprocessor kernels with ACPI
support too.  These kernels should not waste a lot of space on the
NetBSD ISO images and are certainly useful.  On the other hand,
I do not know how mature is ACPI code now.

IPsec is becoming the standard for VPNs really fast and it is a
required component for IPv6.  IPsec is only optional for IPv4.

Cheers,
Igor.