The existing RSA based security polices define algorithm URLs for the different algorithms which are part of the profile (AsymmetricSignatureUrl etc.). These URLs are not defined by the ECC profiles which leads to confusion.
Within the SG discussion we figured out that these URLs are not needed, because the algorithm is defined by the policy.

So maybe the following fixes the issue:

1. Define the algorithm as empty string within the profiles.
2. Adopt the description of signature data and tell, that an empty string is allowed for the signature algorithm.

Maybe the same applies for the EncryptedSecret or EccEncryptedSecret