The child policy of BootstrapPolicy should not be used as part of the normalization and vocabulary of the currently being processed message as it's just used to setup the policy for the interaction with the secure conversation endpoint.
webservices/wss4j/trunk/policy/src/main/java/org/apache/wss4j/policy/builders/BootstrapPolicyBuilder.java