Bruno Barras Verification of the Interface of a Small Proof System in Coq. 28-45 1996 conf/types/1996 TYPES db/conf/types/types96.html#Barras96