Add information about BoringSSL change to CHANGELOG.md.

CHANGELOG.md

 ## 1.14.0
 
 ### Core library changes
 * `dart:math`
   * `Random` added a `secure` constructor returning a cryptographically secure
     random generator which reads from the entropy source provided by the
     embedder for every generated random value.
 
 ## 1.13.0
 
@@ skipping 14 matching lines @@
 
 * `dart:core`
   * `Uri` added `removeFragment` method.
   * `String.allMatches` (implementing `Pattern.allMatches`) is now lazy,
     as all `allMatches` implementations are intended to be.
   * `Resource` is deprecated in favor of the resource package.
     See https://pub.dartlang.org/packages/resource to learn more. This is
     the last release to contain the Resource class.
 
 * `dart:io`
+  * **Breaking:** Secure networking has changed, replacing the NSS library
+    with the BoringSSL library. `SecureSocket`, `SecureServerSocket`,
+    `RawSecureSocket`,`RawSecureServerSocket`, `HttpClient`, and `HttpServer`
+    now all use a `SecurityContext` object which contains the certificates
+    and keys used for secure TLS (SSL) networking.
+
+    This is a breaking change for server applications and for some client
+    applications. Certificates and keys are loaded into the `SecurityContext`
+    from PEM files, instead of from an NSS certificate database. Information
+    about how to change applications that use secure networking is at
+    https://www.dartlang.org/server/tls-ssl.html
+
   * `HttpClient` no longer sends URI fragments in the request. This is not
     allowed by the HTTP protocol.
     The `HttpServer` still gracefully receives fragments, but discards them
     before delivering the request.
   * To allow connections to be accepted on the same port across different
     isolates, set the `shared` argument to `true` when creating server socket
     and `HttpServer` instances.
     * The deprecated `ServerSocketReference` and `RawServerSocketReference`
       classes have been removed.
     * The corresponding `reference` properties on `ServerSocket` and
@@ skipping 563 matching lines @@
     they will keep the Dart process alive until they time out. This fixes the
     handling of persistent connections. Previously, the client would shut down
     immediately after a request.
 
   * **Breaking change:** `HttpServer` no longer compresses all traffic by
     default. The new `autoCompress` property can be set to `true` to re-enable
     compression.
 
 * `dart:isolate`: `Isolate.spawnUri` added the optional `packageRoot` argument,
   which controls how it resolves `package:` URIs.