diff --git a/encoder.go b/encoder.go
index 720e28a..eaee1c7 100644
--- a/encoder.go
+++ b/encoder.go
@@ -17,6 +17,18 @@ import (
 	"time"
 )
 
+var keyUsages = []x509.KeyUsage{
+	x509.KeyUsageDigitalSignature,
+	x509.KeyUsageContentCommitment,
+	x509.KeyUsageKeyEncipherment,
+	x509.KeyUsageDataEncipherment,
+	x509.KeyUsageKeyAgreement,
+	x509.KeyUsageCertSign,
+	x509.KeyUsageCRLSign,
+	x509.KeyUsageEncipherOnly,
+	x509.KeyUsageDecipherOnly,
+}
+
 var keyUsageStrings = map[x509.KeyUsage]string{
 	x509.KeyUsageDigitalSignature:  "Digital Signature",
 	x509.KeyUsageContentCommitment: "Content Commitment",
@@ -210,9 +222,9 @@ func hexify(arr []byte) string {
 func keyUsage(sKu simpleKeyUsage) []string {
 	ku := x509.KeyUsage(sKu)
 	out := []string{}
-	for key, value := range keyUsageStrings {
+	for _, key := range keyUsages {
 		if ku&key > 0 {
-			out = append(out, value)
+			out = append(out, keyUsageStrings[key])
 		}
 	}
 	return out
diff --git a/tests/dump-cert-chain-to-text.t b/tests/dump-cert-chain-to-text.t
index b071a7a..6544de1 100644
--- a/tests/dump-cert-chain-to-text.t
+++ b/tests/dump-cert-chain-to-text.t
@@ -127,8 +127,8 @@ Dump a live cert chain (squareup-chain.crt)
   Authority Key ID : C3:F7:D0:B5:2A:30:AD:AF:0D:91:21:70:39:54:DD:BC:89:70:C7:3A
   Basic Constraints: CA:false
   Key Usage:
-  \tKey Encipherment (esc)
   \tDigital Signature (esc)
+  \tKey Encipherment (esc)
   Extended Key Usage:
   \tServer Auth (esc)
   \tClient Auth (esc)