selecting users for a special role in a workeflow is usually done with a swimlane, please check out the user guide at http://docs.jboss.com/jbpm/v4/userguide/html_single/
there is no special x.509 handling code in jBPM so you have to bring your own signing/validation/encrytion stuff