I’m sorry I have to get into this discussion, even if it is somewhat off-topic 
I absolutely agree with @Gankro here, there is a fundamental difference between “trusting the rest of the universe” and “trusting your own implementation”. This difference is pretty clear when it comes to proving stuff.
Right now, when I want to prove Vec correct - where correct means “no safe clients can cause crashes or data races” - then I will consider the entire module Vec is defined in. I assume the rest of the world to be some (safe!) Rust program that does just about whatever it wants with my module. I can now prove that Vec is correct, because I know all the code that ever touches len, and can verify that every such access maintains the invariant. This is possible right now even though there is no such thing as an unsafe field, because len is private.
Now, let’s try to prove that spawn is correct, and lets assume we look at the entire libstd. Again we assume that the rest of the world (i.e., everything outside libstd), calling us, is some safe Rust program. Because it is a safe program, I know it does not contain any implementation of Send or Sync. I can thus prove that there will be no data-races, since I know all the types in libstd actually are thread-safe. (Really, rather than considering the entire libstd at once, one will first try to figure out what Send and Sync actually concretely promise to the rest of the world, and then prove this locally for every implementation, while relying on it in every consumer.)
Now, if you take away unsafe traits - there is just no way to have spawn. Note that we crucially relied above on the fact that the safe Rust program calling us does not implement Send or Sync. Without unsafe traits, we cannot make such an assumption. We would either have to remove spawn from libstd, or give up on our goal of having a “correct” libstd in the sense that safe code can cause no havoc (in other words, we’d be in C++).
So: Unsafe traits are needed to fulfill Rust’s promise of safety with respect to an arbitrary, safe client. Unsafe fields are not.
