Insert sigs in scriptSig in order of the signers (updated)

We don't know in advance what position we'll end up in.

Also, the existing code sometimes inserted in the third position for 2-of-3, which doesn't exist.
I only just noticed this. Why are we using assertThat here rather than assertEquals?