We should do away with the "RequestPolicy" and "ResponsePolicy" subpolicies and just make one, unnamed policy that 
requires signature over the body and WS-Addressing headers.  

Doing so enables us to bind this policy at the level of WSDL messages (e.g., input/output/fault messages, instead of 
WSDL operations).  This is also good because we get rid of the assignment of semantics to specifically-named subpolicies
.  (For anyone who might be concerned: binding of such policy at the operation-level is acceptible for response messages
 that don't include WS-Addressing headers: WS-SecurityPolicy has "if these elements are present, you should sign them" 
semantics.)