Isn't the difference in it being required, and opt-out (unsafe) in rust, but opt-in here? Also, my understanding is the rust compiler guarantees "soundness" in safe rust, so it checks and validates that the function signatures (with annotations like lifetimes) are correct