Which is more secure PEPP-PT or DP-3T? Which of these population tracking protocols is better from a cryptography point of view?


Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT)
Decentralized Privacy-Preserving Proximity Tracing (DP-3T)


I have read a paper discussing some of the security concerns, but it does not go into much detail about the cryptographic technology involved.

For example, what happens if Bluetooth keys are compromised? Is revocation possible in practice? How is key generation performed in the first place? Are keys generated locally by each device?
None of them is secure. Both include dramatic privacy risks:


PEPP-PT build a a central database with all social interactions
D3-PT allows for linking of infection reports to individuals:


Simply record all Rolling Proxymity Identifiers you see and there timestamps with a simple continuously scanning BLE device (e.g. Raspberry Pi)
Process this list against the infection warnings. 
You now only need to match this timestamps with other transactions on entrances, point of sale, CCTV or logon

D3-PT also allows nation states to contact trace suspects by 


injecting fake alerts in seized mobiles
suppressing alert display during risk analysis (like silent SMS work), 
but using risk analysis to identify individuals

A similar technique can be used with active beacons to find out who was at a certain place at a certain time
Someone can relay (receive with an own device, transmit via internet anywhere, send out to somewhere else with  an BLE extender) all broadcasts received near a covid test station to self quarantine anyone.