The safe/unsafe annotation doesn't currently mean anything for prim.
Just in case we decide it means something later it's better to stick
to using one or the other consistently. We decided that using safe
is the better one to require (and it's also the default).