sort by GCM > SHA-2 > SHA-1; AES-256 > AES-128; ECDSA > RSA (1/2)