"Formal proofs cannot, by themselves, establish that a machine-readable specification captures everything humans intended."
Buterin explicitly argues that raw human intentions cannot simply be supplied to a formal proof checker as though they were already mathematical specifications. This supports the manuscript's distinction between certifying formal consistency and determining whether the right goals have been expressed.
View Source