9/12 can anyone point to me an example of a formal security proof that a TCB is secure up to level C or level B? - i'm interested in what they construe is a formal proof.