Well, if it is really not specified anywhere, I think this rests on shaky foundations if "trusted" means "trust that the implementor did what I think he did". What about thread-safety? As an analogy, are @safe functions allowed to access __gshared globals, should they?