I should note that we would only verifying the ordering if we don't canonicalize the DACL.

FWIW, I think we probably should order it properly when writing it, or else all the callers have to know the rules about that, which could be painful to implement.

If that's the case, we would ignore ordering here, but perhaps write another test that adds a whole bunch of stuff in a crazy order, but verifies that after round-tripping, we have the desired canonical ordering.