The nonce is used to compute a signature.
yeah djb really does not like it when you inject more randomness into a signature. he really wants you to use his EdDSA (not ECDSA, yes it sounds the same), which doesn't add more randomness and just computes the signature based upon the private key alone.
i think EdDSA probably doesn't leak the private key across outputs but it does it in the weirdest possible way and it's not good to enable replay attacks like that!
Finally, client and server compute their secret encryption key from the exchanged data; the attacker is able to recompute the same key once he has found the internal state and obtained the server’s ephemeral secret.
this is why double ratchet has forward secrecy with newly injected randomness from repeated diffie-hellman invocations!