2.2.2.2.1 Marshaling Unicode Strings in CERTTRANSBLOB
When a [UNICODE] string is returned in the byte array referenced by the pb field of a CERTTRANSBLOB (section 2.2.2.2) structure, each [UNICODE] character MUST be marshaled in little-endian format.