Open Challenges in the Formal Verification of Autonomous Driving