It's common to see implementations want to remove debiasing steps too. E.g. I've seen several implementations of "derandomized DSA" for Bitcoin (e.g. javascript tools, hardware wallets, etc. We obviously do this right in Bitcoin core) that do not re-roll if the result is over the order, they just take it mod the order.

Complaining to the implementers has just resulted in <whine>thats more complicated, mod is fine</white> And, indeed, for secp256k1 the differences is 1 part in 10^38, so its not likely of practical importance; unless you can assume an attack that can extract an _awful_ lot of signatures from you.

I expect the same behaviours are common for different parameters where it's not such a small bias.