A formally verified compiler for Coq