Is `BTreeMap` safe to use when serializing?

[fjarri]

EchoRoundMessage uses it, and various evidences too. Do serializers generally support it? What happens if keys repeat? We need it to be an error. Should we use Vec instead to be on the safe side? Or we can write a wrapper type that serializes as a Vec.

[fjarri]

Testing some popular format crates:

• in serde_asn1_der: BTreeMap is not supported;
• in bincode: BTreeMap is serialized as a list of pairs, on deserialization if the keys repeat only the last entry is kept;
• in cbor, rmp-serde, serde-json, toml: BTreeMap is serialized as a map.

So there are two problems here:

• some formats (like ASN.1, or at least some implementations of it) simply do not support what we're trying to serialize;
• some crates allow for making a message arbitrarily large while still keeping it valid, which may lead to DoS attacks (this one also applies to BTreeSet, which will also be successfully deserialized from a list with repeating elements).

It seems like we do need to wrap all BTreeMaps in the serialized data into something that serializes as a vector of pairs. And using serde_asn1_der for tests will help uncover places where it wasn't done.