First wins makes some sense from a security pov. You want to load the more "trusted" configuration files first because they must be able to further restrict the

First wins makes some sense from a security pov. You want to load the more "trusted" configuration files first because they must be able to further restrict the less trusted files, but don't want to let the less trusted files override the settings set by the trusted files. Rejecting multiple definitions is better, unless you care about DoS (I would be pissed if I got locked out of ssh access due to an option being defined twice, for instance).