Why not generate the authentication key from the key and nonce in GCM? In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $H$ as $H$ is derived only from $K$. So, why not derive $H$ from $K$ and $N$ (the nonce).
So, why not derive $H$ from $K$ and $N$ (the nonce).


Well, if you are asking why the original GCM designers made that specific design decision (CodesInChaos point is valid, but software implementations weren't actually considered in the original design):


A critical goal in the GCM design was that it be hardware pipeline friendly; that is, you could process the message in a 10-14 stage pipeline (where each AES round was a separate pipeline stage), and that there are minimal wasted steps.  Doing some additional computation before you could process the initial AAD data would cause a break in the pipeline, and so violate this goal.
It wouldn't help.  If the $H$ value was derived from an $N$ and $K$ pair, then if you repeat an $N$ value, you still repeat the $H$ value (and hence leak that $H$ value).  What your idea would mean is that the attacker would have to repeat the $N$ value to forge (as the attacker wouldn't know the $H$ value for any other $N$); however that is not a practical issue for attackers, who can freely pick the $N$ value for their forgeries.