Trustworthy Tools for Trustworthy Programs: A Verified Verification Condition Generator