update CHANGELOG for 532, 540 and 541 (#549)

- #532
- #540
- #541

Also fix some whitespace

CHANGELOG.md

@@ -10,8 +10,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - SSH `print-cert` has a new `-raw` flag to get the PEM representation of a certificate. (#483)
+
 - New build architecture: Linux `riscv64`. (#542)
 
+- New experimental config option `remote_allow_ranges`. (#540)
+
+### Deprecated
+
+- The `preferred_ranges` option has been supported as a replacement for
+  `local_range` since v1.0.0. It has now been documented and `local_range`
+  has been officially deprecated. (#541)
+
 ### Fixed
 
 - Valid recv_error packets were incorrectly marked as "spoofing" and ignored. (#482)
@@ -21,6 +30,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Signing a certificate with `nebula-cert sign` now verifies that the supplied
   ca-key matches the ca-crt. (#503)
 
+- If `preferred_ranges` (or the deprecated `local_range`) is configured, we
+  will immediately switch to a preferred remote address after the reception of
+  a handshake packet (instead of waiting until 1,000 packets have been sent).
+  (#532)
+
 ## [1.4.0] - 2021-05-11
 
 ### Added