JSR 106 (XML Digital Encryption API) has been stuck in Public Review for a year now, 11 months past its finish date. Since JCP process is as transparent as one-sided mirror, your guess is as good as mine. Its companion, JSR 105 (XML Digital Signature API), is bundled with Java 1.6 and JWSDP 2.0 but Sun has been pointing to Apache XML Security project for XML encryption. FYI, Sun's JSR 105 implementation is a repackaged version of Apache XML Security library.
On the Apache XML Security front, looks like version 1.4 is ready to be released except it hasn't because the release guy doesn't have time to update the web page. Funny. If you want to build one for yourself, beware that some elbow grease will be needed. I expected such a key open source project to be in a better state than it appeared to be.