As most know, a duplicate nonce with GMAC/GCM allows key recovery attacks against GMAC itself and thus the ability to forge messages. This is because GMAC computes GHASH and then just XORs this with AES(j) where j is the GCM counter. If a nonce is duplicate you get identical AES(j) which lets you XOR and get the raw GHASH and then attack the GCM polynomial.
Why doesn't GCM encrypt its final authentication tag using AES in ECB mode (one ECB block)? If performance is a concern and you want to avoid doing two AES encryptions why not do AES(GHASH(m) ^ j) or similar? GHASH(m) XOR AES(j) seems like it's begging for sudden death on nonce reuse. Why do that?
It seems like this simple design change would have made GCM/GMAC more resistant to nonce repetition. You'd still be able to XOR ciphertexts just like you can with any stream cipher when a nonce is repeated but you wouldn't be able to compromise the authentication key, right?