Give guidance on reconfiguring YubiKeys with unprotected management keys

Closes str4d/age-plugin-yubikey#21.

i18n/en-US/age_plugin_yubikey.ftl

@@ -170,7 +170,14 @@ plugin-err-pin-required     = A PIN is required for {-yubikey} with serial {$yub
 
 ## Errors
 
-err-custom-mgmt-key      = Custom unprotected management keys are not supported.
+err-custom-mgmt-key = Custom unprotected management keys are not supported.
+rec-custom-mgmt-key =
+    You can use the {-yubikey} Manager CLI to change to a protected management key:
+    {"  "}{$cmd}
+
+    See here for more information about {-yubikey} Manager:
+    {"  "}{$url}
+
 err-invalid-flag-command = Flag '{$flag}' cannot be used with '{$command}'.
 err-invalid-flag-tui     = Flag '{$flag}' cannot be used with the interactive interface.
 err-invalid-pin-length   = The PIN needs to be 1-8 characters.

src/error.rs

@@ -48,7 +48,21 @@ impl From<yubikey::Error> for Error {
 impl fmt::Debug for Error {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            Error::CustomManagementKey => wlnfl!(f, "err-custom-mgmt-key")?,
+            Error::CustomManagementKey => {
+                wlnfl!(f, "err-custom-mgmt-key")?;
+                let cmd = "ykman piv access change-management-key --protect";
+                let url = "https://developers.yubico.com/yubikey-manager/";
+                writeln!(
+                    f,
+                    "{}",
+                    fl!(
+                        crate::LANGUAGE_LOADER,
+                        "rec-custom-mgmt-key",
+                        cmd = cmd,
+                        url = url,
+                    ),
+                )?;
+            }
             Error::InvalidFlagCommand(flag, command) => writeln!(
                 f,
                 "{}",