Visible to the public Trustworthy Kernel Separation through Monads