[adrianmonk]

> compiler has no way of knowing if a function will later be a signal handler after linking, or even dynamic loading

You could check it at runtime.

Just like with array bounds checking, in many cases the compiler could sometimes prove the runtime check isn't necessary and eliminate it.

> Which functions are async signal safe varies with the operating system and runtime

Annotations could enumerate specific platforms where it is safe or unsafe. Or you could annotate based on specific attributes of platforms that make it safe or unsafe.