Right way to handle input in critical applications?
Usually safety critical switching requires more then one input. 

Typically you either have two inputs per switch wired to sense opposite conditions and logic to go to fail to a safe state if the appropriate conditions are not met, or something like using an analogue input pin with a chain of three resistors such that short, open, switch open and switch closed can be detected as distinct states (If you are really paranoid you can have two of these things with opposite contact states and different potential divider strings . 

Your choice of external or internal debounce is a side issue, but I would be very careful about interrupts in a SIL 3 or 4 project, they are hard to justify, especially when driven from an external pin because they make the state machine that is the processor very hard to reason about (And a complete nightmare to debug). Personally I like a polled input, with a simple software timer for debounce, a chip that is not on the board cannot have a dry joint. 

I would note also that the design of buttons themselves for safety critical applications has been studied, NASA did an extensive study on the design and ergonomics of the switch that commands the destruction of a rocket at the range safety officer position, it is interesting.