uglier and more complicated because you're constructing a proof of something It's rare for the programmer to actually produce proofs that a piece of code meets

uglier and more complicated because you're constructing a proof of something It's rare for the programmer to actually produce proofs that a piece of code meets the spec given by its type[1]. Those proofs are generally produced by the type checker, possibly with occasional hints from the programmer. 1: Even in Coq, detailed specs for some code are typically given (and proven) separate from the code itself rather than in that code's own type.