Comment by steveklabnik

From the link:

"The intention is to make these as safe as possible so that modules written in Rust require the smallest amount of `unsafe` code possible."

When writing a kernel, some unsafe somewhere is always required, on some level.