I know I've seen this explanation before and cannot find it.

I'm going on this assumption and hopefully I have this right.

If you are signing or encrypting with a security token, let's say an X509
token, you could add the token to the security.Tokens collection and also
use that token to create your element (let's say EncryptedData).

Or you can skip adding the token to the Tokens collection and only add it
through the EncryptedData element.

So given that my assumption is correct...what is the difference? When and
why would you use one method over the other? I thought Hervey explained part
of this. That WSE will first look in the element for the token and if it's
not there, go look in the tokens collection.

thanks

Julie