In practice it's the order in which credentials were attempted, which is also the "natural" ordering of the items. I will state that ordering SHOULD be provided by implementations.