I was curious too, found answer in comments of original publication: > Normally there is just one XChaCha12 invocation per encryption or decryption. There's an

I was curious too, found answer in comments of original publication: > Normally there is just one XChaCha12 invocation per encryption or decryption. There's another to derive subkeys, but that's only needed when setting a new key.