Order of trustedSigners in config file affects trust evaluation

[rido-min]

I'm using the next config file

<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
  <config>
    <add key="signatureValidationMode" value="require" />
  </config>
  <trustedSigners>
    <repository name="NuGet.org" serviceIndex="https://api.nuget.org/v3/index.json">
        <certificate fingerprint="0e5f38f57dc1bcc806d8494f4f90fbcedd988b46760709cbeec6f4219aa6157d" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
        <owners>Microsoft</owners>
      </repository>
      <author name="msAuthor">
      <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
    </author>
  </trustedSigners>
</configuration>

To install the next package

nuget.exe install system.buffers

but it fails with

NU3034: Package 'System.Buffers 4.5.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.

however if I change the order in the configuration file, and move the author element first, then the install succeeds.

/cc @PatoBeltran @dtivel

[PatoBeltran]

This has been merged into 4.9.3 and dev.