pub/rsa-recover.c, pub/rsa.h: Say what's left when `rsa_recover' fails.