> One might hope you have a formal spec of a cryptographic library. Which would be a good first step, but wouldn't protect against timing attacks or Spectre-li

> One might hope you have a formal spec of a cryptographic library. Which would be a good first step, but wouldn't protect against timing attacks or Spectre-like hardware frailties. A solid start is better than nothing, but a false sense of security is worse than nothing.