Visible to the public Correctness by Construction: Developing a Commercial Secure System