Initially, a validator has no last committed anchor.
Theorem: last-anchor-when-init
(defthm last-anchor-when-init (implies (and (system-initp systate) (in val (correct-addresses systate))) (equal (last-anchor (get-validator-state val systate)) nil)))