In some cases, we have functions which have safety properties as an accident of implementation, but we might want to reserve the right to turn them into into unsafe functions later. Is there a way to express this in the annotations? -- Florian Weimer / Red Hat Product Security