[wss] Questions regarding X.509 Certificate Token Profile

I have some questions regarding the WSS X.509 Certificate Token Profile
spec. 

1. At line 245 and 292, it states "The KeyInfo element specifies the signing
key...". 
    As I understand, the actual specified key is not a signing key. It is a
public key 
    or verification key.

2. At line 212, it states "contains the binary X.509 security token data".
It is not clear to me
   the binary X.509 refers to DER encoded binary or PKCS#7 binary format. 

Kefeng Chen