WSE 3 and x509 certs

I am not sure if this has been addressed some where already...

I want to secure web service calls used by about 40 pc's

the pc's are locked down to have limited user functions.

is there a way I can update my smart client app and have the clients use my secured web service -- where I see a possible problem is that I can't allow the clients to open web browsers and accept the x509 cert.

we will use a private cert server so that the only authorized pc's can call the web services.

I am thinking of using the "UsernameForCertificateAssertion" policy so the client just needs to have the servers public key.

how can I do that with code

can I get a hex / xml public key  and put it into the app.config

and then use that at runtime to supply the needed data