Leonardo de Moura designed Lean with a minimal trusted kernel to allow users to build and run independent kernel checkers