Add TLS&auth and subqueries to roadmap

Signed-off-by: Julius Volz <julius.volz@gmail.com>

content/docs/introduction/faq.md

@@ -221,6 +221,11 @@ second, will only run into precision issues after over 285 years.
 
 ### Why don't the Prometheus server components support TLS or authentication? Can I add those?
 
+Note: The Prometheus team has recently changed their stance on this and
+support for TLS and authentication in serving endpoints is now on the
+[project's roadmap](/docs/introduction/roadmap/#tls-and-authentication-in-http-serving-endpoints).
+As long as this is not implemented yet, the advice below still applies.
+
 While TLS and authentication are frequently requested features, we have
 intentionally not implemented them in any of Prometheus's server-side
 components. There are so many different options and parameters for both (10+

content/docs/introduction/roadmap.md

@@ -30,6 +30,21 @@ Backfilling will permit bulk loads of data in the past. This will allow for
 retroactive rule evaluations, and transferring old data from other monitoring
 systems.
 
+### TLS and authentication in HTTP serving endpoints
+
+The HTTP serving endpoints in Prometheus, Alertmanager, and the official exporters
+do not have built-in support for TLS and authentication yet. Adding this support
+will make it easier for people to deploy Prometheus components securely without
+requiring a reverse proxy to add those features externally.
+
+### Ranged subqueries
+
+Currently PromQL only allows range selectors on raw series selectors, not on
+arbitrary PromQL expressions. This makes it necessary to introduce intermediary
+recording rules to compute some results (like the `max_over_time()` of
+a `rate()`). [Subquery support](https://github.com/prometheus/prometheus/issues/1227)
+will enable computing those results in a single query.
+
 ### Support the Ecosystem
 
 Prometheus has a range of client libraries and exporters. There are always more