It's a bit of both IIRC. You're right that limiting checks to the function signature avoids accidentally leaking implementation details, but it also means that

It's a bit of both IIRC. You're right that limiting checks to the function signature avoids accidentally leaking implementation details, but it also means that checking functions can be done entirely locally. Not having to recursively inspect called function implementations to determine whether there is a type/borrow checking error scales much worse than only needing to look at function signatures.