Replicated database with a formally-verified implementation of Paxos