Pull the Safe annotation out of TRUSTWORTHY ifdef