As for "the hashpower that is out there that we don't know about"... All of the hash power that is out there is hash power that we don't know about. Miners don't report their hash rates. They only way we can estimate network hash rates is by looking at how fast blocks are being produced.

We can infer that the expected number is relatively close to the actual number because, for example, if the actual number were twice as much, we would expect to have twice as many blocks.

Think of it this way: The difficulty determines the expected number of hashes needed to find a block, regardless of who is doing the hashing.

Here is a simple example: suppose you have a group of people, each rolling a 6-sided die as fast as they can, and in order to win a round a 1 has to be rolled. Because the probability of rolling a 1 is 1/6, we know that it takes an average of 6 rolls to roll a 1. It doesn't matter who is rolling their die, or how fast they are rolling it. It will take an average of 6 rolls. Sometimes it takes more and sometimes it takes less, but the expected number of rolls is 6 for each round.

Now, the actual number of rolls is probably very different from 6 for each round, but as more and more rounds are played, the actual number is likely to get closer and closer to the expected value. That is the purpose of the standard deviation. The standard deviation measures the probability the actual number of rolls being different from the expected number of rolls by a certain amount.

Again, none of this is actual measurement. It is all probability. When you can't know the actual count, you can still compute the expected count and you can compute the quality of that value (in terms of probability).