proof ok, with a few aux trustmes