Option to choose which private key to sign message

[Fred Victa]

I have a Web Service that uses WS Security. My Web service application uses a keystore that contains two private keys. My Web service receives an incoming XML message and responds with an outgoing XML response message. My application needs to sign the outgoing XML response message with one of the private keys. How can I get my application to choose which private key to choose? I have a Rampart configuration set up in an XML file, but this configuration allows only one <user> tag. I tried having multiple <user> tags in the Rampart configuration, but that did not work.