The key in all this is the users ability to choose to disclose when they were tested as infected. If this choice isn't baked deep into the protocol, it will be

The key in all this is the users ability to choose to disclose when they were tested as infected. If this choice isn't baked deep into the protocol, it will be far to easy for things to go horribly wrong down the road as this technology is adapted for other roles. As an obvious (and not all that impossible) example, consider a Bluetooth device owning person who is, in fact, physically isolated. No amount of "privacy preserving" anything will fix the issue if they know they've only been within range of 2 other people in the last <insert time window here>. The paranoid user would want to change their disclosure settings upon entering the domain of this isolated individual, since they can be sure they would be able to identified. Sadly, not all users will know who was and who was not isolated, so the notion of privacy is simply impossible as far as I can tell. You are weighing the social good vs the potential personal harm based on your unique environment. Nothing fundamentally changes this.