WS-* and XML cryptography is such a clusterfuck. It's ironic to see Amazon injured by use of "standard" constructions; they'd have been better off rolling their own here.
You shouldn't really be surprised though; especially after Yegge's rant the other week. Software quality at Amazon is pretty mediocre, and pales in comparison to Google's (I worked at both places.)
