In regards to the mail shirt vs breastplate thing, attacks are checked against the armor worn at that given location but the problem is that only one layer of armor is checked against. Testing in the arena revealed that when I entered the breastplate first and the mail shirt after, all attacks to the upper body were checked against the mail shirt. Conversely when I entered mail shirt first and then breastplate the attacks were checked against the breastplate. In either case upper arm attacks were always checked against the mail shirt.
There's likely a similar issue behind protection of fingers, toes and facial features, but I've never had any luck protecting them aside from blocking, dodging and parrying.
So I guess the solution is to make sure when equipping your soldiers that they put on the mail shirt first, and then the breastplate over that. I've heard concerns about wearing a cloak or robe over everything and totally ganking your armor, but I've personally never seen an issue with that. Then again I haven't much experience with actual in-game combat vs arena testing.
As for weapons like spears and whips penetrating armor, that's just what they do. Weapons have different stats such as contact area and penetration depth. Slashing attacks can be very damaging but have a lot of contact area and therefore is much less useful against armor. Weapons and attacks with smaller contact areas, primarily piercing, have much better chances of penetrating armor. It's possible for a copper spear to penetrate steel armor and for bronze armor to deflect a steel axe. A lot of it is based on the skill of the attacker and defender as well.
To help put whips into perspective:
Contact area values:
Battle Axe hack: 40000
Short Sword slash: 20000
Short Sword stab: 50
Mace bash: 20
War Hammer bash: 10
Whip lash: 1
I'm afraid whips are a bit overpowered at the moment.