move unsafety into function sigs