Shall cargo-audit, like cargo-geiger, track which functions are used and which are unused by the target crate and filter out vulnerabilities in unreferenced functions?

Otherwise there will be a stream of vulns in seldom used functions in deep dependencies, which would train users to shovel them away without much consideration, as most of then are not to the point. Or, if there would be little advisory traffic, will "penalize" crates or authors by figurating in a report even though the vulnerability is just in a tiny experimental doc-hidden non-default-feature-cfg function which almost nobody knows about (or be a reason against filing such advisories as insignificant).