Enforce that KeyDescriptor nodes appear before NameIDFormat ones

Inside a SSO, the KeyDescriptor must appear in the XML tree before
the NameIDFormat nodes.