Preserve order of found issuer certificates to be able to control order and exception that is shown.
Otherwise it is arbitrary which certificate is tested last which is the one that controls the error message shown if none validates.
Take the authority key identifier extension into account when searching for issuer certificates