Formal control and trustworthiness: shall the twain never meet?