Be helpful, tell user when one-time password may be incorrect

The regular (still present) error message when typing wrong OTP is the long and incomprehensible:

stprov local run: add data: post data: do request: Post
"https://192.168.12.42:2009/stprov/v0.0.1/add-data": x509:
certificate signed by unknown authority (possibly because of "x509:
invalid signature: parent certificate cannot sign this kind of
certificate" while trying to verify candidate authority certificate
"serial:0")

This also outputs the following line if the wrapped error is of type x509.UnknownAuthorityError:

The one-time password may be incorrect.