[imh]

One of the interesting parts of this is the distinction between different types of applications: safety critical and otherwise. If, as other commenters are saying, no we can't trust libraries, but yes we have to anyways, then a library may be good enough for non-safety critical applications and get all the adoption and work. Then you come along with your safety critical application for which this library isn't trustworthy enough (by assumption). What are you to do here?

I'd love to see a bigger ecosystem of safety critical code floating around. Libraries in it would be less full-featured and optimized than their less trustworthy counterparts with wider adoption, but it's a niche I really hope to see develop as code takes over the world.