We basically have zero ability to do formal verification against information leakage through cache timing attacks and the like.