zope.interface.declarations returns a global _empty Declaration object in a few cases. But this object is fully mutable: its bases can be set, it can be subscribed and have dependents added. That doesn't seem safe for a global object.

Can we either:

• Stop returning a global object from these APIs (return a new object); or
• introduce a special subclass that's truly immutable (prohibits changing bases, adding dependents, etc).