What's So Safe About Unsafe Rust