> Secure software won't protect you from insecure hardware

Then what's KPTI etc.?

> which also needs to be formally verified for a secure system.

Now we just need a correct and complete theory of quantum mechanics and to do something about that Heisenberg thing.

In general formal proofs tell you if something is true given a stipulated set of assumptions. They don't tell you if one of the stipulated assumptions is wrong or can be caused to be wrong on purpose by doing something nobody had previously known to be possible.