DNSSEC sign metrics: CHANGES, doc, release note

Add some information about the new statistic-channel DNS sign
metrics. Also add a CHANGES and release note entry.

CHANGES

+5254.	[func]		Collect metrics to report to the statistics-channel
+			DNSSEC signing operations (dnssec-sign) and refresh
+			operations (dnssec-refresh) per zone and per keytag.
+			[GL #513]
+
 5253.	[port]		Support platforms that don't define ULLONG_MAX.
 			[GL #1098]

doc/arm/Bv9ARM-book.xml

@@ -5425,6 +5425,8 @@ options {
 		<command>zone-statistics terse</command> or
 		<command>zone-statistics none</command>
 		in the <command>zone</command> statement).
+		These include, for example, DNSSEC signing operations
+	        and the number of authoritative answers per query type.
 		The default is <userinput>terse</userinput>, providing
 		minimal statistics on zones (including name and
 		current serial number, but not query type

doc/arm/notes.xml

@@ -143,6 +143,20 @@
 	  [GL #865]
         </para>
       </listitem>
+      <listitem>
+	<para>
+	  Two new metrics have been added to the
+	  <command>statistics-channel</command> to report DNSSEC
+	  signing operations.  For each key in each zone, the
+	  <command>dnssec-sign</command> counter indicates the total
+	  number of signatures <command>named</command> has generated
+	  using that key since server startup, and the
+	  <command>dnssec-refresh</command> counter indicates how
+	  many of those signatures were refreshed during zone
+	  maintenance, as opposed to having been generated
+	  as a result of a zone update.  [GL #513]
+	</para>
+      </listitem>
     </itemizedlist>
   </section>