I wanted to learn more about secure messaging and started a personal project using the
libhydrogen library. From my understanding, instead of using public-key encryption, the library relies on the noise protocol framework to create ephemeral session keys shared by both parties to encrypt and decrypt messages. I was wondering if the same session keys can be used to sign and verify the messages, or should this better be done with another (not shared) key pair? Also, I couldn't find any information on how long these session keys should last. Are they intended to be used for several days, weeks, or longer, or should I think of a session key as a login to an online service that expires after 10-15min, unless you stay active?
As I said, I am new to the topic and there might be very straightforward answers. Unfortunately, I couldn't find this information myself. Thanks in advance.