Please note: this isn't an introduction to XSA. If you have a question that isn't answered here, please email me.
While we realize that RDF is designed for describing resources so that XSA easily could have been an RDF application, we felt it was more important to focus on simplicity. XSA stands and falls with user acceptance, and so RDF was discarded because it would make the system harder to understand.
This was a harder choice, but eventually I decided against this. OSD contains only three things that XSA can use: product name, product version and vendor name. Changes since last release, several products in one file, contact email, home pages of vendor and product and so on are all missing.
Another reason is that OSD is much more complex than XSA and contains a lot of things XSA doesn't need. To make this system as simple as possible I thought it better to design a new DTD. However, XSA does support an OSD mapping, and the client can read and monitor OSD files as well.