Initially, a validator has no committed anchors.
Theorem: committed-anchors-when-init
(defthm committed-anchors-when-init (implies (and (system-initp systate) (in val (correct-addresses systate))) (equal (committed-anchors (get-validator-state val systate)) nil)))