Breaking this out from #88 to make it separately decidable

The docs should specify whether order of parameters matters and how to determine that (is there a canonical ordering?) My own opinion is that order shouldn't matter.

Closely related is whether all keys are required for the vector or if some may be omitted when information is only partially specified.

Questions that should answer:

• Must vectors always keep key:value pairs in the same order?
• How to handle unspecified elements? This is the omit/include-but-indicate-unknown item. E.g., what if I don't know the answer to Exploitation but I have answers to the others?
• How to handle underspecified elements? E.g., what if I know Exploitation is not PoC but I don't know if it's none or active? Can I use the vector indicate what I do know?