Another vote for the Beretta 92FS, with the safety on (though I wouldn't recommend carrying it this way without PLENTY of practice in flipping up the safety during the draw). But it certainly is plenty safe this way.
The firing pin block prevents the firing pin from moving forward in the channel unless the trigger is pulled completely to the rear (preventing firing if the gun is dropped), and the slide-mounted safety/decocker rotates the firing pin striker completely out of the way of the hammer. To fire, you'd have to very deliberately swipe the safety lever up to the fire position, and pull a long, heavy double action trigger completely to the rear. After that, the Beretta 92 actually has a pleasant single action trigger pull for 17 more shots. Or of course, the decocker can be used to safely lower the hammer again for double action, or to put the safety back on.
The decocker design on the Beretta is great for a few more purposes - chambering a round, and holstering a loaded gun. I have gotten in the practice of chambering a round with the safety lever on safe. The round chambers, and the hammer automatically returns to the fully down position, and the safety is on. Then I holster the gun, and once it is safely and securely holstered, I flip the safety back up to off.