Section 5. defines some operational aspects of AS4 that have to be agreed on in communities. This section obviously does not have to (and cannot) be complete, but it is not clear why section 5.2.6 (b) asks which encryption algorithms and minimum key lengths are required, (c) which Certificate Authorities are acceptable for server authentication etc. these same questions could be asked for SOAP message security, parameters defined in 2.1.3.6