Building High Integrity Applications with SPARK
Altran/Praxis Correct-by-Construction for a cert authority
Galois built Cryptol for NSA but open sourced it.
Rockwell Collins built SHADE and some other tools for high-assurance crypto. They build stuff for the defense sector mainly funded by NSA. They even have a separation-preserving, verified CPU.
Write-ups or examples of some of the above: