The WSS module now correctly removes the certificate from Object Store upon flow completion.
WSS Module Release Notes - Mule 4
Anypoint WSS module enables you to process and validate an inbound SOAP request against a given Web Service Security (WSS) extension configuration to, for example, validate the request signature, perform an LDAP authentication, or decrypt the inbound message. The WSS module also enables you to sign your response by adding a WSS header to it, or to encrypt your outbound message.