True, but do we know if it matters? does the order of the OIDs matter in any case? The only place I see this used is in determining the type of certificate which is doing a non zero check, so the exact item being returned does not matter.