agreed, and you have to get the proofs perfect, in whatever language in which they are expressed, to be useful. like you have to get the code correct twice to make sure it works once.
i think having safe patterns/apis where the compiler can automatically spot classes of potential error is a better approach
is there one with Stalin at the top?