OpenStack operators and folks who automate openstack deployments with tools like puppet rely on the release notes  and config guides  to highlight new, changed, deleted, and deprecated config options. For Keystone Newton both of these guides are missing many features, with one prime example being the new PCI-DSS features . The release notes actually fail to mention these at all although they are documented elsewhere if you knew that you should be looking for them.
The config reference only mentions 1 deprecation, beyond PCI-DSS there was probably more and they are all missing:
Compare this to the new and updated section for kilo which was complete and useful:
 - http://docs.openstack.org/newton/config-reference/tables/conf-changes/keystone.html
 - http://docs.openstack.org/releasenotes/keystone/newton.html
 - http://docs.openstack.org/developer/keystone/security_compliance.html