Log failed keystore lookups in all cases

dovecot/keyproxy.go

@@ -122,7 +122,9 @@ func (s *KeyLookupProxy) lookupPassdb(ctx context.Context, username, password st
 	// If the password is a SSO token, try to fetch the
 	// unencrypted key from the keystore daemon.
 	priv, err := s.keystore.Get(ctx, s.config.Shard, username, password)
-	if err == nil {
+	if err != nil {
+		log.Printf("keystore lookup for %s failed: %v", username, err)
+	} else {
 		log.Printf("passdb lookup for %s (from keystore)", username)
 		return &passdbResponse{PrivateKey: s.b64encode(priv)}, true, nil
 	}