They could do something like OCaml modules and signatures but more permissive. Module author writes the public signature and that's what the type checker runs a

They could do something like OCaml modules and signatures but more permissive. Module author writes the public signature and that's what the type checker runs against, but if you want, you can "downcast" the module to the actual signature, revealing implementation details.