diff --git a/ChangeLog b/ChangeLog
index e199682..b7fb5d5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,10 @@
    * Fix ssl_parse_record_header() to silently discard invalid DTLS records
      as recommended in RFC 6347 Section 4.1.2.7.
 
+API Changes
+   * Deprecate usage of RSA primitives with non-matching key-type
+     (e.g., signing with a public key).
+
 = mbed TLS 2.6.0 branch released 2017-08-10
 
 Security