There has been an issue raised about a security hole related to the order of resources in a document. It is true that the order of resources is not guaranteed by the specification, but I'm confused as to why this is an issue. Arrange the document so that one is signing an ancestor of the elements for which the order matters. Obviously you can't do this if you don't have control of the document format.
Documents formats have to be designed with signatures in mind.
You can't tack a signature onto a document if the DTD doesn't allow it or the application doesn't expect it. Note that in the general case the resource does not have to be a part of the document containing the signature. This approach could also be taken for asserting what is omitted from the document. It is the application's responsibility to verify the resources in the manifest against the actual resources, so verifying the order against the order in the manifest may just be an additional part of that process for some applications. In the general case, one cannot assert an order for the resources in the manifest because they will quite likely be pointing at different documents.