NEWS: Logs can use ML-DSA-44 keys

Author: rgdd

NEWS.md

@@ -17,6 +17,9 @@
 - Added `HashReaderOverlay`, a `tlog.HashReader` that extends a tree with the
   stored hashes of appended records, held in memory.
 
+- Added `NewLogVerifier` to parse a log vkey, accepting regular Ed25519 keys
+  and ML-DSA-44 cosignature keys.
+
 ### mpt
 
 - New package with a Merkle Patricia Trie implementation.
@@ -30,12 +33,16 @@
 
 - The bastion certificate is now generated once at startup.
 
+- Logs can now sign checkpoints with ML-DSA-44 keys.
+
 ### witnessctl
 
 - Added `set-bastions` command, which adds the given bastion(s) to every log
   that has none configured (for example after `pull-logs`), or replaces the
   bastions of every log with `-all`.
 
+- `add-key` and `pull-logs` now accept logs that use ML-DSA-44 keys.
+
 ### litebastion
 
 - Comments and empty lines are now allowed in the backends file.