consuming a WCF service that requires signing

Hi;

We have a WCF service that requires a message to be signed with a X.509 cert.
Cool no problem, i configured the two way send port port to sign the message with my cert on the WCF-Custom config adapter by adding a client behavior and specifying the cert.

I know the WCF service gets the message and I know the cert comes through because I can step into the service and see it; on the return path to bts though it falls over with a he ‘Body’, ‘http://www.w3.org/2003/05/soap-envelope’ required message part was not encrypted.

this seems to happen on the receive shape in my orch as the wcf service has sent out the response.
Is BizTalk expecting the response message to be encrypted?
what’s the problem with this?

anybody know?

Thanks
Ryan