Since the last commit also included the OCSP nonce change

(which I thought I'd included before). I'd better add the
corresponding CHANGES entry.