First, classify by status code. A custody refusal at signing time is 503 key-unavailable: retryable, never the requester's fault, message naming the missing piece. A create or rollover refusal is a policy or readiness error and creates no key. Read the safe reason before changing custody policy.
The rows you will actually meet: a 501 naming "no path to keysvc" is wiring, not a product limit — only keysvc may touch a CA key, so give this process the role or a GOCA_KEYSVC_URL. A wrapped-custody refusal quoting the acceptance gate is the control from frame 78 working. A module "waiting for the PIN" after a restart is runtime-pin doing what it promised: the PIN is never on disk, so it is supplied through the console once per boot — and a wrong PIN latches, because a token counts wrong PINs and blocking it destroys keys.
Then the physical one: "this key requires someone to physically touch its token." goca refuses unattended callers up front rather than making a CRL timer wait 45 seconds for a touch nobody will give. A touch token suits an attended root, never an issuing CA.
Now I can route an HSM refusal to wiring, policy, PIN, or a human finger.