WCF allows you to "expose" your code in any number of different ways.

So the HOST stuff doesn't need to run its code (and get what it needs) thru
IIS, as you suggest.
But it will expose its services via http/ssl if you so choose.

Check channel9 for the Greg Leake videos.
His stocktrader application will actually do it both ways.
1. The host exposes services, but doesn't actually consume services.
2.  The host exposes services, but USES services as well.  (Aka, a second
wcf layer).
You can look at the code at stocktrader.msdn.com ( I think thats it?)

But watch the videos BEFORE you open up the code.

..

You can see my additions to the WCF technology here:
http://sholliday.spaces.live.com/Blog/cns!A68482B9628A842A!158.entry

I have a downloadable example....and you can expose the service through
named pipes or a http web service.

Some thoughts; first - why /not/ IIS? Are you just worried about an
extra attack surface?

Note that actully SSL is not a requirement for secure WCF; you can use
message security and pass the message over http, tcp, carrier
pidgeon[*], msmq, etc. You can also use the host as a service without
IIS, including SSL certificates - but it is harder to do that; IIS is
easy and well documented.
*= you'll need to write your own driver here, I'm afraid

Under the "KISS" principle, I use transport security (https) and IIS,
running the code on those web-servers via IIS, with a firewall and NLB
in front of them and a database server (and another fireall) behind
them. It works well enough for my needs.

Re terminating SSL at the edge devices - note that this *can't* be a
simple passthru such as an NLB (F5 etc) configured to handle https but
use http to the inner-farm. WCF must be configured the same at client
and server: if the client is configured for transport security, the
server must be configured for transport security; and if the server is
configured for transport security it *will not accept* requests over
http. You can use a .NET host/proxy at the perimeter, but I'm not sure
it gains you much.

I use an NLB, but I had to configure it to re-encrypt (with a
different SSL session) between the NLB and the farm. Alternatively, if
you go to message security then your NLB can be a simple pass-thru
again.