Proposal: Checked subprocess calls