What does it take to ship Rust in safety-critical?