Annotations for zeroing the stack of "sensitive" functions which deal in transient secrets

Which is why e.g., bench_black_box was accepted as a hint, and not a language level guarantee. As long as things cannot be specified operationally, I'm not in favor of providing such guarantees.

Which silicon is that specifically? For architecture-specific intrinsics, to the extent we provide guarantees, we only do so on that architecture. Beyond that, when guarantees, rather than something best-effort is sought after, I think the right level to make the acknowledgement is not in a high-level general-purpose language like Rust.