Is this provably safe? I feel like there's been a lot of discussion in the Rust community RE safeness, and my impression from the sidelines is that it's non-trivial.