My take

Call it an educated guess. 

I suspect that someone's account on an ImportantFedoraMachine (eg the authentication server)
was compromised, and as such, they have to treat all the data on that machine as possibly
compromised too.  (eg local exploits become possible)

This trickles down to all other machines that depend on the first; they have to ensure that
they haven't been "compromised" (via info possibly obtained from the first -- eg
passphraseless ssh keys) and their data messed with too.  As the affected machines include the
master fedora distro mirrors, this means that *all* packages ever released need to be
validated (eg SHA1sum) to ensure nothing's been tampered with.

As such, this isn't a problem with Fedora per se; it just happened to be The Fedora Project's
servers that got hit.  It's the sort of thing that could happen to anyone.  Granted, if the
(possibly) compromised servers hadn't included a master distro mirrors, nobody (outside of the
Fedora Admins) would have really cared.

But, hey, I could be completely wrong.  Take this with a massive dose of salt.