KH is part of the material derived from the KDF during the onion key
process.
In the TAP handshake, KH played two roles: it was sent by the server
towards the client to prove that the server was able to complete the
TAP handshake, AND it was included as part of the
RELAY_ESTABLISH_INTRO message to make it impossible to replay a
RELAY_ESTABLISH_INTRO from one circuit on another circuit.
With the ntor handshake, the first value of KH was removed. But we
still needed a shared, circuit-specific value for hidden service
code to work. This value is taken as an additional 20 bytes from
the KDF. It wasn't documented in the spec, though. Adding it here.