Version 2:16.0.0-5 of keystone is marked for autoremoval from testing on Wed 11 Mar 2020. It depends (transitively) on seqdiag, affected by #949934. You should try to prevent the removal by fixing these RC bugs.
CVE-2015-3646: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
CVE-2015-7546: The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
Please fix them.
Last update: 2019-12-15
Standards version of the package is outdated.
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.5.0 instead of