HYDRA: hybrid design for remote attestation (using a formally verified microkernel)
Comprehensive formal verification of an OS microkernel