Well, since this almost happened, one of the first things would be an article on LWN!
As you can see from the previous post about kernel.org, occasionally servers used to distribute packages and code are compromised, just like any other. Exactly how much damage can be done really depends on the level of the compromise, but if a signing key passphrase were captured, the attacker could sign any package they liked, passing it off as a package distributed by the distribution.
The upshot of this would be that client systems would accept the update and the user would be none the wiser - at least until the distribution realised and shipped updated keys and investigated what had been altered.
Unfortunately there isn't much you, the end user, can do to protect against this - the only way you'd know is by analyzing your system for malicious behaviour and (hopefully) finding it.
Before you consider this a Linux-only problem - remember, many companies push updates out from servers, or rely on central signing code. The same set of risks apply (and are even worse if no signing is done). Compromises to root CAs have happened, and the consequences are pretty similar - you end up with a connection that appears valid, that you cannot actually trust.
All of this comes down to a central trust model having a single point of failure, as opposed to the web of trust model which attempts to decentralize the issue. Web of trust models, however, have their own problems.