Just read an argument that C code can be secure because seL4 is secure.
Reminder: seL4 was first written and proved in Isabelle/HOL, then translated to Haskell and proven correct again, then translated to C and proven correct AGAIN. 9,000 lines of C in just 12 worker-years.