pub fn write_trustees(descriptor: &str) -> BTreeSet<String>
Every trustee a DACL grants write access to, canonicalised.