Related question: can we just make the

--tls_allow_unsafe

option available all the time (i.e. don’t use preprocessor macros and conditional compilation for that option)