Soap authentication, HTTP basic authentication, SSL secured connections are all supported out of the box. When publishing a service, Soap authentication + SSL are used.
Webservices over SSL is supported, with public or private keys. There are also lot of WSS protocols out there, are you referring to those?