We should probably have an announcements blog so that people can subscribe to security related notices and whatnot. Subscribing to the changelog page worked for upstream but maybe a blog is better than a wiki for such things?