RFC: Explicit safe interfaces for unsafe code