Describir: Design and Proof of a Mail Service