If we do opt to keep the unsafe, at minimum I would want to factor out the combo of hashes/keys/values vecs into a distinct type that enforces (and checks) the invariant that hashes[0] in order to access any particular key/value. This would be a very small vec-like type where it'd be relatively easy to check the logic.