FWIW there's no conflict there in terms of the cryptography.
A replay-protected, keyed authenticator of plaintext commands (HMAC, etc) is not encryption; it is authentication. In a similar sense you are allowed to put a rolling log-in password on a packet radio BBS, so that passive monitoring will see the password, but as soon as it's revealed, it's no longer useful for additional logins.