When a wrong PIN has been submitted to a Keycard three times in a row, the Keycard gets blocked.
When your Keycard is blocked you can either:
If you want to set up a PUK for your Keycard, you can do it with Shell by inserting your Keycard, entering your PIN (which means your card should not be blocked of course), and go to Settings > Keycard > Change PUK
By default the PUK is set up to a random value when your card is being initialized.