Sure, you formally verified that the software confirms to the specification, but how are you going to prove that the specification is correct?