I have been looking into doing some WSE development (WS Security specifically interested me). In looking carefully at the issues involved (including the issue Scott mentions here), I am wondering whether a move to WS-Security and the rest will buy me anything over and above using Web Services over https? The amount of data transferred using the Web Service in question is relatively small, and the SSL overhead has never been an issue. I currently own the code on both ends of the Web Service request.