Minimize unsafe blocks

Use named rather than inline lambdas to minimize the amount of code that
needs to be inside an `unsafe` block.  Pure refactor, no code change.

Also update safety comments.

Test: keystore2_client_tests
Flag: none, pure refactor of test code
Change-Id: Id10efe4ebad37656222e1f3440e60d526a7ab59a