As far as I understand the actual risk assessment is done by the Contact Tracing Framework. I wonder why this design decision was made. The risk assessment wil

As far as I understand the actual risk assessment is done by the Contact Tracing Framework. I wonder why this design decision was made. The risk assessment will change and the apps done by health organization have the expertise on that subject and shall do the assessment and not the CT framework. It will require an update of the OS to get latest findings published. Privacy and other technical decisions are sound and legit. Has somebody some background information on the reasoning driving that design decision?