[masklinn]

That only tells me a spec and its formal verification are necessary but not sufficient assets. Not "we can't prove everything so we'll keep our millions riding on half-assed piles of garbage.