I have tested signing with various MSI files, but I wouldn't be
surprised if we have to refine a little bit the hashing order.
It took me a while to realize that they probably just memcmp the utf16
OLE directory entry name, and take them in order... I got confused
because libgsf uses utf8, and the stream name themself are weirdly
encoded to pack them in utf16, making it hard to understand why a
stream name "FO"<"AA" but "FA">"AA", anyway...