document dnssec-keyfromlabel

diff --git a/CHANGES b/CHANGES
index 0bbbd1a69128f16d88c2e52be3c167651099a5a4..ed900cb3947eacfea14644504077a29edcc9e377 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -481,6 +481,9 @@
 
 2348.  [func]          Use the EVP interface to OpenSSL. Add PKCS#11 support.
                        Documentation is in the new README.pkcs11 file.
+                       New tool, dnssec-keyfromlabel, which takes the
+                       label of a key pair in a HSM and constructs a DNS
+                       key pair for use by named and dnssec-signzone.
                        [RT #16844]
 
 2347.  [bug]           Delete now traverses the RB tree in the canonical