While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-depth knowledge is willing to share it?

1. The key and the nonce (usually a "number to be used only once") are used twice in this construction: first, to generate the Poly1305 one-time key using the ChaCha20 block function, and second, to encrypt the plaintext using the ChaCha20 function. Why is this reasonable and secure? Especially as both are using a related construction and its stated for ChaCha20 that the nonce "MUST not be repeated for the same key".
2. In the AEAD construction, the nonce is not explicitly authenticated by the MAC. Is it still secure to include the nonce in the AAD as this could be treated (at least in some way) as a reuse of the nonce with the same key? I guess it is secure, but can someone explain why this is so?

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-depth knowledge is willing to share it?

1. The key and the nonce (usually a "number to be used only once") are used twice in this construction: first, to generate the Poly1305 one-time key using the ChaCha20 block function, and second, to encrypt the plaintext using the ChaCha20 function. Why is this reasonable and secure? Especially as both are using a related construction and its stated for ChaCha20 that the nonce "MUST not be repeated for the same key".
2. In the AEAD construction, the nonce is not explicitly authenticated by the MAC. Is it still secure to include the nonce in the AAD as this could be treated (at least in some way) as a reuse of the nonce with the same key? I guess it is secure, but can someone explain why this is so?

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-depth knowledge is willing to share it?

1. The key and the nonce (usually a "number to be used only once") are used twice in this construction: first, to generate the Poly1305 one-time key using the ChaCha20 block function, and second, to encrypt the plaintext using the ChaCha20 function. Why is this reasonable and secure? Especially as both are using a related construction and its stated for ChaCha20 that the nonce "MUST not be repeated for the same key".
2. In the AEAD construction the nonce is not explicitly authenticated by the MAC. Is it still secure to include the nonce in the AAD as this could be treated (at least in some way) as a reuse of the nonce with the same key. I guess it is secure, but can someone explain why this is so?

Thanks a lot already!

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-depth knowledge is willing to share it?

1. The key and the nonce (usually a "number to be used only once") are used twice in this construction: first, to generate the Poly1305 one-time key using the ChaCha20 block function, and second, to encrypt the plaintext using the ChaCha20 function. Why is this reasonable and secure? Especially as both are using a related construction and its stated for ChaCha20 that the nonce "MUST not be repeated for the same key".
2. In the AEAD construction, the nonce is not explicitly authenticated by the MAC. Is it still secure to include the nonce in the AAD as this could be treated (at least in some way) as a reuse of the nonce with the same key? I guess it is secure, but can someone explain why this is so?