When tested positive, to which server the diagnosis keys are reported to can vary depending on the platform and app. It could be reported via a goverment approved app, or reported to Google/Apple provided server. As long as Google/Apple aggregate the diagnosis keys across multiple servers (or even multiple servers across multiple countries), we still take the full advantage of this contact tracing framework.
I didn't mean to suggest that it was. Rather, I was objecting to your earlier claim that there must be an internal and proprietary Apple API used to validate diagnosis keys and that only Apple could mitigate the abuse risk.
> As long as Google/Apple aggregate the diagnosis keys across multiple servers
There's nothing that inherently requires Google or Apple involvement here (although realistically I assume they will end up providing the majority of the servers as a service). All implementations and services including the framework, any apps, and the data server can be done completely independently (if desired) and still interoperate with any Apple or Google provided implementations. That's what's so great about a decentralized system.
Therefore, all authentication must be done on the receiving end by deciding which data sources to trust. This should be fairly straightforward because when a healthcare provider performs testing they are in a position to collect any keys from you at the same time. They are then the ones trusted to accurately report keys, which should be fine since we already trust them both to accurately report test results and to safeguard patient privacy.
Importantly, such a decentralized design allows for cooperative framework implementations, competing app implementations, and multiple data sources. Google or Apple could run a data server, your local government could run a data server, etc. Even more interestingly, such a framework could be repurposed for other less critical uses later as a form of privacy-preserving mutually opt-in contact discovery. Non-essential use of the framework might even ensure that people keep it running all the time, so that the data is ready and waiting the next time a novel pathogen appears.