Inefficient nonce generation for ECDSA #642

Hi, If I understand correctly the nonce generation (https://github.com/bitcoin-core/secp256k1/blob/fa3301713549d118e57ebe6551d062903ddd6b63/src/secp256k1.c#L469L481) it seems that it will generate it once(97 bytes hashed) and if higher than the group order(overflows) or zero(non probable) it will redo it again but increase the amount of hashing by another 65 bytes. again and again. I'm not sure what's the probability for this happening again and again (is it (2^256-order)/2^256 ?) but there's no reason why not to continue the hashing from where we stopped instead of redoing it

In anything but test code, that loop will practically always run just once. The group order is so close to 2^256 that it would be an astronomically unlikely event to ever need 2 iterations.