Detached signing: Combining multiple SignedInfo elements to attach to a SOAP header

I'm currently trying to use this library to sign an RST request using SOAP1.2/WS-SecureConversation (a subset of WS-SE and WS-Trust). Since there doesn't appear to exist any implementations of this as of today, I have to make it on my own.

What the RST looks like before signing (redacted some info, but nothing crucial):

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Header>
    <Action xmlns="http://www.w3.org/2005/08/addressing">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT</Action>
    <MessageID xmlns="http://www.w3.org/2005/08/addressing">urn:uuid:cc1549c2-3fa8-439a-b12e-8170288a34f7</MessageID>
    <To wsu:Id="9ef68234-476e-4797-8f31-73c0cae42eab" xmlns="http://www.w3.org/2005/08/addressing" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">service_url</To>
    <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
      <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
    </ReplyTo>
    <wsse:Security soap:mustUnderstand="true" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-26ac00cb-9651-4e45-ae8f-6d60fc101bcb">#####</wsse:BinarySecurityToken>
      <wsu:Timestamp wsu:Id="TS-f9269060-f3cd-44b9-b55d-08261909ed56">
        <wsu:Created>2016-08-30T09:10:09.177863+00:00</wsu:Created>
        <wsu:Expires>2016-08-30T09:10:09.177863+00:00</wsu:Expires>
      </wsu:Timestamp>
    </wsse:Security>
  </soap:Header>
  <soap:Body>
    <wst:RequestSecurityToken xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust">
      <wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>
      <wsp:AppliesTo xmlns:wsp="http://www.w3.org/ns/ws-policy">
        <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
          <wsa:Address>service_url</wsa:Address>
        </wsa:EndpointReference>
      </wsp:AppliesTo>
      <wst:Lifetime xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wst:Created>2016-08-30T09:10:09.178001+00:00</wst:Created>
        <wst:Expires>2016-08-30T09:15:09.178001+00:00</wst:Expires>
      </wst:Lifetime>
      <wst:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</wst:TokenType>
      <wst:KeySize>256</wst:KeySize>
      <wst:Entropy>
        <wst:BinarySecret Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">###</wst:BinarySecret>
      </wst:Entropy>
      <wst:ComputedKeyAlgorithm>http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1</wst:ComputedKeyAlgorithm>
      <wst:Renewing/>
    </wst:RequestSecurityToken>
  </soap:Body>
</soap:Envelope>

Before this request can be dispatched, it needs to be signed. Specifically, the elements <To> and <Timestamp>. By using the reference_uri argument I can pass each element separately, but the problem is that this also produces two <SignedInfo> fields, and the field <SignatureValue> will of course not be correctly computed (I also need to customize <KeyInfo> after signing, it has to contain a token reference with a SHA1 thumbprint instead of the x509-data, I'm not sure how this affects the validity of the signature?).

Anyway, any suggestions as to how I can make this work? This is the final piece of the (pretty big) puzzle to send this request, and I really like the structure of this library. I'm not expecting this to be supported as is, but perhaps there could be a workaround?

Start by reading the signing API documentation and source around the reference_uri argument, then trace how multiple references produce SignedInfo and SignatureValue. Determine whether one signature can cover both To and Timestamp and how KeyInfo customization affects validation. Done means a valid SOAP 1.2 WS-SecureConversation request with both elements signed and the requested token-reference KeyInfo.