Should We Prove Security Policies Correct?