Are formal methods used for cryptographic protocol design?
In my experience the persons doing the standardization may not know about formal methods in the first place. And even if a formal method was used, they would not know how to assess it.

Note that whatever mathematical method is applied, the security of a protocol is still dependent on how the domain was modelled. If the model is even slightly incorrect, a protocol may still be insecure. It would not be the first time - to put it mildly - that a security proof has to be reconsidered.