Isn't there a third possibility, "I received an email claiming that there's a backdoor" without publicizing all the additional details?

First question: "Who says?" Answer: "I can't say."

Second question: "Is it credible?" Option 1: "Yes" => panic ensues. Option 2: "No" => "Liar!" Option 3: There is no option 3, you must pick 1 or 2.

Why is there no option 3?

"I am looking into the matter; more details will be forthcoming."

Third question: "Did you find anything?" Option 1: "Yes" => panic. Option 2: "No" => "Liar!".

You have to release all the details sometime, but the longer you wait, the more people suspect they aren't getting all the details (even if they are) and the larger the drama whirlpool becomes. Did "Kaminsky found a DNS bug, details will be forthcoming" accomplish anything? No, it was a giant clusterfuck.

As a side note, I think it's weird that in a "post-wikileaks" era people are arguing that an open source project named openbsd be less transparent.

Only if he kept it to himself and didn't mention it to anybody - I don't think that's what the OP meant.

You're only making the conspiracy bigger. :)

You'll have a hard time gathering a small circle of people willing to state, for the record, "We reviewed the code and the invisible bug doesn't exist." Personally, I would want no part in an audit like that.

For a concrete threat, yeah, you fix it first. But the thing about scandals is that delay only incubates a bigger scandal.