I'm very curious to learn how this happened but good thing it was caught so quickly. They say a contributor key was compromised. Do they know which one? How many contributors can make releases? That's kind of a sensitive issue.

Is the installer not signed? Who has access to these signing keys?