safe should be the default. The unsafe part should take the extra typing, not the other way. Make the user prefer the safe way.
Let's find out how painful/painless "safe" is before making that assertion :) I suspect that the rules for safed will be too strict for lots of provably safe code.
-Steve
