I did it in chronological order of discovery and significant application. I agree it should be used as early as possible. Plenty of benefit to that. Further, the Orange Book era systems discovered a heuristic that supports your theory about old codebases: things must be designed for such verification or security from Day 1. Usually impossible to retrofit such properties into an existing codebase whose methods were quite different.