rustls isn't formally verified but no critical CVEs have been found in it yet. The only CVE is one DoS. And I don't know about "used at scale" but we use it in

rustls isn't formally verified but no critical CVEs have been found in it yet. The only CVE is one DoS. And I don't know about "used at scale" but we use it in production for Pernosco.