I've been following this story, and I don't think I've commented at all...but I notice you have asked several times "what would you do", and haven't gotten all that many answers.
I'm going to answer in the opposite way...what I "wouldn't" do is worry about Dad's rights over the safety of my child. Dad should be looking out for himself, for sure, but your #1 job is to make sure your child is safe, not to look out for Dad's legal rights. If Dad's rights are getting trampled, he has the right to address that...that is NOT your responsibility.
Your gut is telling you Dad wouldn't hurt the baby intentionally. His lack of explanation is very concerning, and is likely an effort for self preservation. You have the responsibility to follow the advice of CPS (otherwise YOUR parenting skills could be considered questionable), the doctors you trust, and your lawyer.
What I would do? What you are doing. Keep communication open and allow Dad supervised visits until he completes the requirements CPS puts in place. If CPS didn't follow the law, then it is up to DAD to challenge that, not you. You aren't his lawyer. And if Dad didn't do this, then either he knows who did, or he failed to get medical attention for the baby when it "magically appeared". Either way, sounds like neglect...Neglect is usually unintentional.