The client side wsse metro configuration uses policies like this:
<wsp:Policy wsu:Id="ClientKeystorePolicy"
xmlns:sc="http://schemas.sun.com/2006/03/wss/client">
<wsp:ExactlyOne>
<wsp:All>
<sc:CallbackHandlerConfiguration>
<sc:CallbackHandler name="usernameHandler" default="kermit"/>
<sc:CallbackHandler name="passwordHandler" default="thefrog"/>
</sc:CallbackHandlerConfiguration>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>

We should provide at least an example showing how to leverage custom callback handler; for instance these might use the username/password configured in the context the same way we do for native stack.