fix output of "mox checkupdate", and specify changes to be from newest to oldest

main.go

@@ -1634,8 +1634,14 @@ printed.
 	if latest.After(current) {
 		changelog, err := updates.FetchChangelog(context.Background(), changelogURL, current, changelogPubKey)
 		xcheckf(err, "fetching changelog")
-		fmt.Printf("Changelog\n\n")
+		if len(changelog.Changes) == 0 {
-		fmt.Println(changelog)
+			log.Printf("no changes in changelog")
+			return
+		}
+		fmt.Println("Changelog")
+		for _, c := range changelog.Changes {
+			fmt.Println("\n" + strings.TrimSpace(c.Text))
+		}
 	}
 }
 

serve.go

@@ -235,8 +235,8 @@ requested, other TLS certificates are requested on demand.
 			}
 
 			var cl string
-			for i := len(changelog.Changes) - 1; i >= 0; i-- {
+			for _, c := range changelog.Changes {
-				cl += changelog.Changes[i].Text + "\n\n"
+				cl += c.Text + "\n\n"
 			}
 
 			a, err := store.OpenAccount(mox.Conf.Static.Postmaster.Account)

updates.go

@@ -51,11 +51,12 @@ func cmdUpdatesAddSigned(c *cmd) {
 	// todo future: enforce this format?
 	sig := ed25519.Sign(privKey, buf)
 
-	changelog.Changes = append(changelog.Changes, updates.Change{
+	change := updates.Change{
 		PubKey: privKey.Public().(ed25519.PublicKey),
 		Sig:    sig,
 		Text:   string(buf),
-	})
+	}
+	changelog.Changes = append([]updates.Change{change}, changelog.Changes...)
 
 	var b bytes.Buffer
 	enc := json.NewEncoder(&b)

updates/updates.go

@@ -76,7 +76,7 @@ type Change struct {
 // prevent a potential future different domain owner from notifying users about
 // new versions.
 type Changelog struct {
-	Changes []Change
+	Changes []Change // Newest first.
 }
 
 // Lookup looks up the updates DNS TXT record at "_updates.<domain>" and returns