AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC can be found in source 1 and source 2.
Now most protocols still use AES/CBC. I understand this in case a KDF is not used. But currently I am reading about the Signal Protocol which also uses AES/CBC with HKDF as the KDF.
So my question is: Why would Signal Protocol use AES/CBC when AES/GCM is obviously has better performance?
EDIT
I just tested (using JMH) AES/CBC vs AES/GCM on a Java implementation and AES/CBC actually beat AES/GCM in performance. I am aware now why Signal Protocol uses AES/CBC but I don't understand how. Signal documentation (section 3.3 after the image) says
"Alice then calculates an "associated data" byte sequence AD that contains identity information for both parties".
And later says Alice sends "An initial ciphertext encrypted with some AEAD encryption scheme 4 using AD as associated data and using an encryption key which is either SK or the output from some cryptographic PRF keyed by SK." Now I downloaded Signal Protocol source (Java implementation) and did a search they never call updateAAD (a java function to set the additional authenticated data).