Why are r and s modulo N? (not P) As Peter Wuille mentions here, the ECDSA signature values (r, s) are modulo N (eg verifying ECDSA signatures, where u1 = z * w % N), whereas the rest of the ECDSA functionality in Bitcoin seems to be modulo P.

Why is this so?
Good question! There are two concepts here. The finite field Fp, and the EC Group defined by secp256k1.

In Fp, elements are just numbers modulo p. Addition, Subtraction, Multiplication, and Division are all defined for this finite field.

In the EC Group, however, each element is a pair of elements in Fp, such as (f1, f2). You can add and subtract these pairs to get different pairs, but the addition and subtraction has little to do with the addition and subtraction of elements of Fp (technically it uses those operations under the hood, but it's not direct addition. That would be pretty boring if (f1, f2) + (g1, g2) just gave you (f1+g1, f2+g2)). 

Also note that since these pairs are a mathematical Group, rather than a field, there's no way to multiply two pairs. You may have seen the syntax k*G before, but this is just shorthand for adding G to itself k times, k is an integer rather than another element of the EC Group defined by secp256k1.

Additionally, if you look at the ECDSA algorithm, you will see that here the final elements are (r, s), but just because it is a pair does not mean it is a pair that lives on the secp256k1 curve! This is a pair of integers mod n (the curve order), as defined by the algorithm, not a point on the curve.