Your prod.keys must match the firmware version of the file you are trying to extract. Newer games or system updates often require updated keys dumped from a console running that specific firmware.
If hactool shipped with a valid prod.keys file, it would become a "circumvention device" ready to decrypt copyrighted game content out of the box. The developers would face immediate legal liability from Nintendo. By forcing the user to obtain their own prod.keys from their own console, hactool exists in a legal gray area as a "format-parsing tool" rather than a "piracy tool." The missing keys error is thus a legal firewall: the tool is capable of circumvention, but it does not perform it without an explicit, user-supplied key. hactool prodkeys does not exist