I found that even with LLMs making sure the formal specification covers what you actually want is challenging.

How do you actually know what the LLM proved is what you want?