varx/tech on Nostr: In general, what's the best way to have signatures over dictionaries without ...

In general, what's the best way to have signatures over dictionaries without canonicalization attacks or parser mismatch?

Dictionaries seem to be *really* susceptible to this—with a repeated key, two implementations might disagree on whether the first or the second key "wins" (or simply on whether the data is even parseable).

Approaches I can imagine:

- Specify that implementations *really ought to* reject anything with repeated keys, weird Unicode sequences in keys, etc.
- Avoid maps entirely, and instead have lists of pairs (which implementers *definitely won't* just feed into a dictionary)
- Use data formats that are really strict in their spec about how to handle repeated keys, and ensure that all the major libraries for that format follow the spec
- Something protocol-level, like asking the implementers to pretty-please re-serialize the data and ensure it hasn't changed

Am I missing some option?