We need to enrich the ws-security policy samples with a testcase featuring an endpoint configured for supporting encrypting responses for multiple clients. Basically that's possible using the "ws-security.encryption.username = useReqSigCert" CXF feature.