Encrypted proof token in wsfederationhttpbinding

I have written a WCF c开发者_Go百科lient that uses wsfederationhttpbinding in order to authenticate to a STS and RPS. I recently noticed (using Fiddler) that the response received from the STS includes a SymmetricKey for the proof token (as I have configured the client to request) but that the proof token is not encrypted.

A few questions about this:

1. As I understand it, if the proof token is not encrypted, there is no point to it (e.g. does nothing extra to prevent a Man in the Middle attack)
2. How do I request the STS to encrypt the proof token?
3. Can I provide a public key in my RST to the STS in order for it to encrypt the proof token?
4. If so, how do I configure my WCF client to do this?

Thanks in advance...