If you want to contribute (implement something from the current list, or
anything), contact the developer's mailing list (gnutls-dev@lists.gnupg.org),
in order to avoid having people working on the same thing. 

Current list:
* Priority strings should also set the minimum acceptable DH key size and
  certificate size.
* When importing a PKCS #11 certificate, check for its issuers to generate a
  chain (e.g. use the DN to retrieve possible signers).
* Think about supporting the groups in RFC3526 and RFC5114. If other
  implementations use them too we may be able to achieve some speedups
  in DH (by knowing q).
* Handle the following X.509 extensions:
   2.5.29.36: Policy Constraints
   2.5.29.33: Policy Mappings
   2.5.29.54: Inhibit Any-policy
   2.5.29.46: Freshest CRL
   2.5.29.30: Name Constraints
* Improve AES assembly. AES in nettle can be improved in x86, arm and
  x86-64.
* Add support for RSA-PSS. This signature algorithm is seen in some
  passport CAs. Should be added in nettle and then in gnutls.
* Move ECC code to nettle.
- Add DTLS 1.2 support (RFC6347)
- Add certificate image support (see RFC3709, RFC6170)
- RFC 3280 compliant certificate path validation.
  - Reject extensions in v1 certificates.
- Certificate chain validation improvements:
  - Implement "correct" DN comparison (instead of memcmp).
  - Support critical key usage KeyCertSign and cRLSign.
  - Support path length constraints.
- Perform signature calculation in PKCS #11 using not plain
  RSA but rather the combination of RSA-SHA256, RSA-SHA1 etc.
  That will allow the usage of tokens that do not allow plain RSA.
- Support PKCS#8 DES-MD5 (tests/enc3pkcs8.pem) encrypted keys.
  (openssl seems to use DES-MD5 to encrypt keys by default)
- Add support for generating empty CRLs
- Document the format for the supported DN attributes.
- Audit the code
- Allow setting a PKCS #11 module to gnutls_x509_trust_list_t, to verify 
  against, similarly to NSS way.
- Support replacing individual algorithms via a PKCS #11 module -
  maybe use p11-kit for that.
- Add function to extract the signers of an openpgp key. Should
  be similar to gnutls_x509_crt_get_dn_oid().
- Add function to verify an openpgp key against a plain key.
- Clean up name space of helper functions in library (memmem,
   firstElement, bit_mask, ...) for platforms that libtool's
   -export-symbols-regex doesn't work.
- Add Kerberos ciphersuites
- Update the current test suite, using the newest NIST's PKI Test vectors,
  see http://csrc.nist.gov/pki/testing/x509paths.html
- Make gnutls-cli-debug exit with better error messages if the
  handshake fails, rather than saying that the server doesn't support
  TLS.

(+) Means high priority 
(*) Means medium priority
(-) Means low priority (ie. nobody is interested to develop that)