Why does deriveKey(...) become getTlsKey and getP256Key? It's just key materials for any type of keys IMO?

The previous tappd API is still available at /var/run/tappd.sock. The renamed APIs serves on /var/run/dstack.sock.

Another approach would be to symlink stack.sock to tappd.sock, and serve the same API with backward compatibility. Which one do you think is better?

Why does deriveKey(...) become getTlsKey and getP256Key? It's just key materials for any type of keys IMO?

It isn't just key materials. The two types of key get different pubkeys and the pubkey is included in the cert chain or signature chain which proves the key's origin and owner(app-id).
Under the hood, getEthKey generates the keys locally while getTlsKey fetches the certificate from KMS each time, as KMS cannot issue an intermediate CA certificate for the application due to security constraints.

Another approach would be to symlink stack.sock to tappd.sock, and serve the same API with backward compatibility. Which one do you think is better?

Since all of the APIs have changed, I think a hard separation might be better as it forces the new apps to use the new APIs so that we can drop the old API support earlier. What's your preference?