This was hard to prove in agda, so... coq.