I have never claimed that it's easy. I said doing it is simple, and prone to errors, and needs to be verified either by design or tests, ideally both. I'm aware

I have never claimed that it's easy. I said doing it is simple, and prone to errors, and needs to be verified either by design or tests, ideally both. I'm aware of seL4. They're doing an amazing job of verifying what they have written. However, why I'm is so adamant is because I have done something similar myself, albeit in a weaker form, but at least I verified that every part of my code is not doing funny things by vigorously testing it in valgrind in different scenarios both in units and end to end. Again, I'm not against Rust. I'm against vilifying languages.