I think all the use of `unsafe` in this library is pre-1.0 stuff that can be made safe now. We should do that.