Safe Haskell trust revocation lacks runtime mechanism for expired credentials

Context

Safe Haskell enforces least-privilege compilation through Safe, Trustworthy, and Unsafe module classifications, restricting primitives like unsafePerformIO at compile time. Trust is granted statically when a module is marked Trustworthy and accepted by the compiler.

Problem

There is no standard mechanism to revoke or expire that trust after compilation, analogous to credential rotation or expiration in capability-based systems. A Trustworthy module audited today remains trusted indefinitely, even if its maintainers later discover a vulnerability or withdraw support. Meanwhile, the GHC steering committee has an open proposal to deprecate Safe Haskell entirely, adding migration uncertainty for codebases relying on these flags.

Goal

Determine whether a practical pattern exists—within current GHC or via libraries—to enforce time-bounded or revocable trust for modules compiled with -XTrustworthy, without abandoning Safe Haskell's compile-time guarantees.

What alternatives provide runtime capability revocation compatible with Safe Haskell's module hierarchy? How should teams architect least-privilege boundaries today given the deprecation proposal? Is there a migration path that preserves safety invariants if Safe Haskell is removed in a future GHC release?