You only need to decrypt once the payment has been received, so the private key doesn't need to be sent to the infected machine before that. Encrypt/Decrypt, it seems to be a moot point.

The "decrypt one file for free" feature seems to be specific to CryptoWall which, some have reported, do not use symmetric encryption like CryptoLocker. CryptoLocker stores symmetric keys for each file on the infected machine, encrypt those with a public key and when the payment is received, send the private key from the C&C Server. I would say it's very unlikely CryptoWall would store remotely a private key per file. That could mean a lot of information to be transferred over the wire. Probably because of using only asymmetric (slow) encryption, CryptoWall apparently only encrypt small files completely, and only a piece of the larger ones. One way the "decrypt one file for free" feature might work is by actually uploading the file (or the the encrypted piece of file) to the C&C Server, decrypting it remotely and sending it back. But the feature is definitely worth investigating.

https://blog.fortinet.com/post/cryptowall-another-ransomware...

http://stopmalvertising.com/malware-reports/cryptowall-behin...