Start release notes for 2.16.9

Change-Id: I926efa61599e828b00784c206c76610a38daacda
diff --git a/pages/site/releases/2.16.md b/pages/site/releases/2.16.md
index d6e02ce..ceab014 100644
--- a/pages/site/releases/2.16.md
+++ b/pages/site/releases/2.16.md
@@ -528,6 +528,29 @@
 
 ## Bugfix Releases
 
+### 2.16.9
+
+* Don't send "GPG keys added" notification when no GPG keys were added.
+
+  A GPG key update can include both addition and removal of GPG keys. The
+  notification email for addition of new keys was always sent, even if the
+  update only removed keys.
+
+* Add methods to generate and set the HTTP password on the accounts API.
+
+* [Issue 10549](https://bugs.chromium.org/p/gerrit/issues/detail?id=10549):
+Fix single tab indentation in PolyGerrit diff view.
+
+* Hide project-aware top menus from PolyGerrit header.
+
+* Upgrade highlightjs for syntax highlighting fixes:
+
+  * Treat `False`, `None` and `True` as literals in python.
+
+  * Fully support C++11 raw strings in cpp.
+
+* Upgrade elasticsearch-rest-client to 7.0.1.
+
 ### 2.16.8
 
 * [Issue 10695](https://bugs.chromium.org/p/gerrit/issues/detail?id=10695):