I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly.
The libsodium docu suggests to hash it with: h(q ‖ pk1 ‖ pk2). As hash function h() I want to use SHA-256. As the output is 256 Bit I would just use the lower half.
Why do you append the public keys there? Shouldn't h(q) be good enough?