How to protect the user passwords and passphrase from root

Boot from a LiveCD, then mount the / harddrive partition. You can now chroot into your harddrive and just run passwd as root there changing the root pw. That's also the way to change to grub password.

Disabling the root password isn't really useful. Either there's a way to become root without using the password (such as another system service, or a security hole in a program running as root), in which case whatever you do about the password is irrelevant; or becoming root requires the password, in which case a strong enough password is as secure as disabling the password.

A strong password has to withstand brute force attacks. There is a first layer of security, which is that ordinary users cannot read the password hash, so they can only make attempts by calling su or login or a similar service. Even if an attacker manages to obtain the password hash, they have to calculate hashes by brute force until they find the right one. OpenBSD properly uses a slow hash; if you want your password to withstand a billion-CPU bot for 10 years, a password with 60 bits of entropy (13 random letter) is overkill.

So my recommendation is to generate a strong random password, write it down on a piece of paper, and store it in a physically secure place. That way you have the password available in an emergency.

Of course, if you set up sudo, then your account becomes the weakest link, and there is no point in securing the root account more than your account.

OpenBSD offers a security feature that restricts the root account: the securelevel. If you set the securelevel to a positive value, then certain actions (including changing the securelevel, loading kernel code, and modifying files marked as immutable) are restricted to kernel code. This can be used to guarantee the integrity of a part of the system even if the root account is compromised; the downside is that console access is required in certain situations such as a failing hard disk. See File protection in Unix and How to guarantee the integrity of an OS? for more details, as well as the documentation.