I would disagree that this is not “formal verification” as that discounts the entire software supply chain and how attacks actually show up.

Is this end to end verification? Cause this sounds closer to validation than verification.