Signature and encryption in security policy

Hi,

Would like to discuss two topics regarding WS-Policy security
implementation.

Signature and encryption of request are controlled by SignedParts,
EncryptedParts policy assertions.
But, as far as I can see, these assertions can be active only together with
AssymetricBinding, SymmetricBinding or TransportBinding assertions.
Asymmetric/Symmetric BindingHandler get signing/encryption element lists
from AbstractBindingHandler and call appropriate WSS4J function to sign or
encrypt message parts.
Asymmetric/Symmetric BindingHandler is called from
PolicyBasedWSS4JOutInterceptorInternal interceptor associated with
AssymetricBinding, SymmetricBinding or TransportBinding assertions.
That means, if client has a policy ONLY with SignedParts, EncryptedParts
assertions, WITHOUT AssymetricBinding, SymmetricBinding or TransportBinding
it does nothing with message.

Two questions:

1)      Basically I can see some use cases where signing/encryption can be
done without authentication, for example encryption request only. In this
case client just get public key of service and encrypt request message.
Actually, client haven't authenticate itself for this scenario. Are there
special reasons always to bind SignedParts, EncryptedParts with
AssymetricBinding, SymmetricBinding or TransportBinding?

2)      Actually if client defines policy containing only SignedParts,
EncryptedParts assertions CXF does nothing and send unsigned/unencrypted
message. Exception is thrown only on service side (Assertion is not
satisfied). I find it a little bit dangerous, because client can assume
that message is encrypted. IMHO exception should be thrown already on
client side.

Regards,
Andrei.