WSS signature enveloped

I am unable to get signed soap request with

<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

and X509Key instead of reference. Using 4.0.1. How do I make it work, it seems to fairly basic requirement, surprised that it is not supported with documented config.