Using same keypair for Diffie-Hellman and signing Are there any security risks using a single key-pair for both key-exchange and signing?

I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, such as EC-DH and EC-Schnorr or even EC-DSA with the same key pair would be interesting too.


Curve25519 hashes the output of an x-coordinate only Diffie-Hellman key exchange
Ed25519 is a slight variant of EC-Schnorr signatures.


I saw some recommendations to avoid using a single key for multiple purposes, but I couldn't find anything concrete.
The paper "On the Joint Security of Encryption and Signature in EMV" shows that ECIES and EC-Schnorr signatures can be used together without compromising security:


  In the random oracle model ECIES-KEM and EC-Schnorr are
  jointly secure if the gap-DLP problem and gap-DH problem are both hard


Ed25519 is extremely similar to EC-Schnorr, and both ECIES and Curve25519 are based on EC-DH, so this gives some indication that using both Curve25519 and Ed25519 with the same key-pair is secure.

Still a proof that directly refers to a keyexchange as used in Curve25519 would be nice.