formal verification continues to come up, but it has the issue that you can only formally verify problem domains you already expect -- and the advanced threat actors for which formal verification is necessary have the toolkit to go off-script to find vulnerabilities.

I think the hype around formal verification also tends to misdirect away from the verification that strong type systems already do if used correctly, though vitally not at the protocol level.