whatsnew: hmac *digestmod* accepts strings, and default is deprecated. (#17276)
whatsnew: hmac conforms to pep 247. (#18775)
whatsnew: SSLcontext.load_verify_locations cadata argument (#18138)
whatsnew: sys.__interactivehook__. (#5845)

I decided to leave the (slightly expanded) Other Improvements
entry as well, since someone looking for command line behavior
changes isn't going to look in the 'sys' module section.
whatsnew: SSLSocket.getpeercert new values returned. (#18379)
whatsnew: plistlib new api and deprecations (#14455)

Also fixed the versionchanged/deprecation tags in the docs.
#20871: improve email policy test coverage.

More tests of the concrete policy methods would probably be
a good idea, but this is a start, and it brings line coverage
up to 100% for the policy module.

Patch by Milan Oberkirch.
Issue #20875: Merge from 3.3
whatsnew: SSLContext.verify_flags and constants. (#8813)
whatsnew: deprecation of sysconfig SO key (#19555).
whatsnew: more accurate deprecation section titles.
Issue #20875: Prevent possible gzip "'read' is not defined" NameError.
Patch by Claudiu Popa.
whatsnew: venv with_pip, pyvenv --without-pip (#19552)
#19953: Clarify the wording of the augmented assignment discussion.

Patch by Priya Pappachan, based on suggestions from Terry Reedy
and myself.
Merge #19953: Clarify the wording of the augmented assignment discussion.
whatsnew: pdb works for debugging asyncio programs (#16596).
whatsnew: SSLContext.load_default_certs (#19292).
whatsnew: allowZip64 defaults to True (#17201).
whatsnew: ssl.create_default_context (#19689).
whatsnew: cp1125 codec (#19668).