Improve logging on DP failures

[brockallen]

Perhaps emit better log saying what item/record can't be unprotected, and say old DP keys can't be accessed to unprotect, and indicate the ID of the record to remove if they no longer need it.