I don't get auth_hash, I presume that this is either a configuration option for the hash algorithm to use or an output instead of an input. As you already split the ciphertext and the authentication tag, that leaves us with the additional key.
GCM has been specifically designed as an AEAD cipher. So it makes sense that the construction only uses a single key.
With encrypt-then-mac the cipher and MAC algorithm are separate algorithms. Basically it is not proven that using the same key for both the cipher and the MAC doesn't introduce weaknesses. It is even known that using CBC mode encryption and CBC-MAC is dangerous (although the key would still be protected by the cipher).
That said, it is pretty unlikely that encrypt-then-HMAC is vulnerable to attacks. HMAC is a strong algorithm and the hash is pretty far apart from the usual cipher implementation. So it is rather unlikely that using the same key for both introduces issues. It is however best practice to use two different keys for two different purposes, if just to help with security proofs.