Update notes for submitted changes

* DNSSEC: separate low level signing interface from SIG(0) code