Given that package servers serve packages over HTTP, you can already do this, identifying the user you want to serve different packages by their IP.

However, the packages need to be signed by Fedora for the package manager to accept them, so this has been considered a pretty weak excuse for an "attack" for a while now. "Getting access to code-signing keys allows you to attack the people consuming signed binaries"—wow, you don't say!