I.e. WSSE config (an example taken from Metro, but it applies to our wsse config as well):

<wsp:Policy wsu:Id="MyServicePortBindingPolicy">
<wsp:ExactlyOne>
<wsp:All>
<sc:TrustStore wspp:visibility="private" peeralias="testclient"
storepass="client" type="JKS"
location="D:\full_path_to_my\client_keystore.jks"/>
<sc:CallbackHandlerConfiguration wspp:visibility="private">
<sc:CallbackHandler default="password" name="passwordHandler"/>
<sc:CallbackHandler default="ThisDoesNotMatter" name="usernameHandler"/>
</sc:CallbackHandlerConfiguration>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>

The key is 'wspp:visibility="private"'