Which HMAC scheme more secure? Which HMAC scheme is more secure? Or are they of the same level of security?
Scheme One

Compute a HMAC on the data to encrypt (cleartext/plaintext)

Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext


Scheme Two

Compute a HMAC on the data to encrypt (cleartext/plaintext)

Encrypt the data with AES_CTR_256, and append above HMAC to end of ciphertext

Compute another HMAC on the ciphertext_HMAC combo and append it; ciphertext_HMAC_HMAC


And also, would using the same HMAC key be secure for scheme two?
The first scheme is similar to what's called Encrypt-and-MAC. It is not ideal, but it is not fatally broken, and it is still used by the SSH protocol securely. You need to include a counter or other unique value in the data being MACed to maintain IND-CPA security (i.e. identical plaintexts don't have identical MACs).

The second scheme you present doesn't really make sense. I can't see what benefit it would provide. Generally, you would want to use Encrypt-then-MAC, or EtM, a scheme where the plaintext is encrypted, the MAC is computed over the ciphertext and appended directly to it. EtM is a better scheme because it gives away no information about the plaintext, even if the MAC is broken. It also gives you the benefit of allowing you to discard a forged message without needing to decrypt it first, to prevent some attacks.

See also Should we MAC-then-encrypt or encrypt-then-MAC?



On a side-note, you should use AEAD instead. For AES, that means selecting an authenticated mode like GCM, which is both fast and secure. Although HMAC can be used safely, AEAD is usually better.