> What stops a malicious actor for triggering the API in a dev or jailbroken environment? Server side authentication stops this. Sure a jailbroken device can

> What stops a malicious actor for triggering the API in a dev or jailbroken environment? Server side authentication stops this. Sure a jailbroken device can call whatever local APIs they want, but to have a non-local effect you have to update some centralized server where the list of infected keys/users is stored for downloading by other devices. Given that, it's straightforward for the server to require some admin-level credential specific to their service. The source of truth for covid-19 positive devices/keys is still centralized and gatekept by each state/national agency's contract tracing service. (But identity/location info isn't centralized)