Created attachment 3360 [details]
Patch to provide readable return codes for pkcs11 identities

Right now, if I typo my PIN for a PKCS#11 token, I get the inscrutable message:

$ ssh -I /path/to/module user@example.com
Enter PIN for 'SSH key':
C_Login failed: 160

I'd prefer to receive a more useful message:

Login to PKCS#11 token failed: Incorrect PIN

I've attached a patch that adds specific handling for three common
error cases: Incorrect PIN, PIN too long or too short, and PIN locked.
I've also tweaked the fallback error case to indicate that it is a
PKCS#11-specific error. Hope this is useful!