changelog: summarise user-visible parts of http signature rework

CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Added
+- timestamps of incoming HTTP signatures are now verified.
+  By default up to two hour old signatures and a maximal clock skew
+  of 40 min for future timestamps or explicit expiry deadlines are accepted
+
+### Fixed
+- federation with bridgy now works
+- remote signing keys are no longer refreshed multiple times per incoming request
+
+### Changed
+- inboxes now fake a succcess reply on incoming Delete documents whose signing key is unknown but gone;
+  this prevents older Mastodon from repeatedly trying to deliver Deletes of actors we never knew anyway
+
 ## 2025.03
 
 ## Added