Sketch of KeepSafe (formally documented as SafeSource)