On Linux/macOS, the user running hactool may not have read permissions for prod.keys . Fix with:
If hactool shipped with a valid prod.keys file, it would become a "circumvention device" ready to decrypt copyrighted game content out of the box. The developers would face immediate legal liability from Nintendo. By forcing the user to obtain their own prod.keys from their own console, hactool exists in a legal gray area as a "format-parsing tool" rather than a "piracy tool." The missing keys error is thus a legal firewall: the tool is capable of circumvention, but it does not perform it without an explicit, user-supplied key. hactool prodkeys does not exist
Save as hactool.bat in the same directory as hactool.exe, and use it like: hactool your_file.nca On Linux/macOS, the user running hactool may not
If you are trying to decrypt specific game content, you may also need a title.keys file in the same directory. By forcing the user to obtain their own prod