Flesh out changelog some more

This is a sort-of TODO list at the top of the list, but we use it to keep
track of what we need to do.

CHANGELOG.md

@@ -10,7 +10,20 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 Over time, a number of bad things have snuck themselves into these bindings. This
 is a list of changes which are planned for a 1.0 release.
 
-- Plug some subtle memory leaks in the public API.
+- Plug some subtle memory leaks in API:
+  - Public
+  - Secret
+
+Under errors, the current code can leak binaries. I don't want that to happen, so we
+are going to use a better cleanup scheme in the code base.
+
+- Play the mutex game with:
+  - Generic Hash multi-part types
+  - Sign multi-part types
+
+The resource-variant structs need to be mutex-protected. Otherwise we run the risk of
+having multiple simultaneous updates to the hash state without having proper critical
+sections applied. The current code is subtly in error!
 
 ## [Unreleased]