Can Lean model game hops and extract reductions? HOPSCOTCH says yes, with mechanized IND-CCA, ElGamal, and GGM proofs.

Paper gives batched OT with O(λ√ℓ) communication, via Damgård-Jurik + trusted setup or power-DDH without one.