I actually took a few minutes and skimmed some of the online training modules that USDOT put out for developers. There are problems, and they "sort of" admit to them. If I read this correctly, there are only ~105K possible keys, though I'd love to be wrong - otherwise this should fall to a brute-force attack in seconds. Just slam on your brakes, record the outgoing packets, and try every key until one decodes as "putting on my brakes, dude!" And now you have enough information to force any car to let you merge in, whether the driver wants to or not. Which, heck, might actually improve safety. I don't know. Could go either way.
As far as privacy, it's still pretty weak (=totally cracked). They aren't recording the MAC addresses of the cars per se, or so they say, but you could from first principles tell what factory a car came from and its approximate date of manufacture. That's useful - narrows it down to a manageable number of vehicles. Or just passively monitor an intersection with a license plate reader and record every "putting on my brakes, dude!" message. Now you have a table of license plates and MAC addresses. I can't see, frankly, that licence plate reader vendors won't sell this as an optional feature for a modest additional charge.
A big problem, and one discussed elsewhere, is that re-keying this thing is going to be a pain. It doesn't support over-the-air keying, and the intent is that a dealer will periodically re-flash new certificates/keys. That's a tall order. For this to work, cars will have to accept some pretty old keys (insert stars wars joke about older codes but they check out, above), increasing the odds they'll have to accept previously compromised keys. Which will probably be had by dumping the flash.
Anyway, the layer 1 and 2 protocols over the air are 802.11p, and what looks like a quasi-layer-3 is IEEE 1609. So get started.
Another commenter has asked about GPS errors. Looks like the standards explicitly support a very-short-range form of differential GPS and I wouldn't be surprised to see some sort of localizer used to reinitialize a Kalmann filter at some point. Pretty easy these days.