States that one may flip a coin 256 times to create a key. So does the book “Mastering Bitcoin.” That key could violate the noted restriction.
To be beyond this upper limit by flipping a coin 256 times, your first 127 flips would have to be either all heads or all tails, depending on which face you assigned to "1". 127 consecutive identical flips with a fair coin is
incredibly unlikely to happen.
But even so, generating private keys the most common way, i.e. by a piece of wallet software deriving them from a seed phrase, could still result in you generating a number which is above this upper limit. Deriving keys from a seed phrase simply uses the left 256 bits of a SHA512 output as the private key, which could equally as likely be above this limit. All good wallet software will have a procedure in place to deal with this.
Suppose I pick a private key within the forbidden range and generate an address from that key. I strongly suspect that an analysis of the generated address cannot be used to detect the invalid range.
You are right in saying you can infer nothing about the private key from knowledge of only the address. Generating an address from such an invalid private key would have one of two outcomes - either your software would return an error, or it would calculate a new private key modulo
n and use that instead.
Why does this limit exist?
It is an inherent property of the curve bitcoin uses and the generator point of that curve. The curve order
n is such that when multiplied by the generator point G, you get the point at infinity. It is the limit to how many distinct points there are on the curve.
Start with G. Add G to get 2G. Add G again to get 3G. Repeat. Once you've added G a total of
n times, you hit the point at infinity. This means there are
n-1 distinct points on the curve.
