It was my understanding that when specifying a security policy through
the WSE 2.0 Toolkit, I could create a policy for a specific endpoint.
That is, I could have two .asmx files in my Project and create a
security policy that applies to just one of these two files.  Is this
understanding correct?

I am a bit perplexed because I created two .asmx files, policy.asmx and
nopolicy.asmx, and configured policy.asmx to have a receive policy that
required a digitally signed UsernameToken, while I did not provide a
policy for nopolicy.asmx.  (The way I specified the policy for
policy.asmx was through the WSE 2.0 security policy wizard, specifying
the endpoint as http://localhost/DIR/policy.asmx.)

Now, in my client I create two Web References, one to each of the .asmx
files.  If I just call the Web service without adding a UsernameToken
and signing the message, I get a SOAP fault back saying that the
request did not map to the policy.  Oddly, I get this same error
REGARDLESS of what .asmx file I call.  Shouldn't my calls to
nopolicy.asmx go through without the policy check?

Thanks