4 ms·
As you guessed, my main reason is there aren't standard constructions around SIV modes for ChaCha20Poly1305, although as Brian Smith notes in that thread SIV is
by bascule 9y ago
As you guessed, my main reason is there aren't standard constructions around SIV modes for ChaCha20Poly1305, although as Brian Smith notes in that thread SIV is a general construction which should be easy to adapt.
See my comments in that same thread for some early hints at Miscreant.
AES is also more ubiquitously available in hardware, which is nice when targeting slower devices like embedded/IoT.