A Web Browser with a Formally Verified Kernel