Verifying Red-Black Trees