Fixpoint wf_btree_over t :=
match t with BNode keys children =>
(length keys = 2 * d + 1)%nat /\
(children = [] \/ length children = S (length keys) /\ Forall wf_btree_aux children)
end.

Lemma split_wf : forall keys children i c (Hc : nth_error children i = Some c)
(Hover : wf_btree_over c) (Hrest : Forall wf_btree_aux (remove_at i children))
(Hkeys : (d <= length keys <= 2 * d)%nat)
(Hchildren : length children = S (length keys)),
wf_btree_aux (split (BNode keys children) i) \/
wf_btree_over (split (BNode keys children) i).