jBPM is an application running above a container. The container is responsible for the establishment of channel security. You could run jBPM over an insecure channel or a container that does not provide SSL/X.509. Basically - jBPM does not and should not know. Your question would be more appropriately directed to the AS7 forum (but basically the answer there will be the affirmative).
Cheers, Steve.