Lessons from Formally Verified Deployed Software Systems (arxiv.org)