This is fundamentally an issue of transport vs message based security - endpoints are the demarcation points for transport security, e.g SSL, whereas the software infrastructure has more control/flexibility over message based security - this issue has been addressed earlier here - When should I use Message layer encryption vs transport layer encryptionWhen should I use Message layer encryption vs transport layer encryption