And in fairness, they could use a special hashing mode so at least the signature is used for both commitments without an additional N byte hash. But that is getting complex.