While no official word is out yet, it is not difficult to speculate that the private keys have likely been leaked.

The curious part is that various downstream projects need to take this action rather than the issue being solved upstream.