Ad-hoc mode hotspots cannot (yet) use WPA for kernel-related reasons, but AP-mode hotspots should have no problem using WPA.  The default hotspot creation code only creates WEP connections though.

panels/network/net-device-wifi.c::start_shared_connection() should get updated to do something like:

	/* Use real AP mode if the device supports it */
        if (nm_device_wifi_get_capabilities (NM_DEVICE_WIFI (device)) & NM_WIFI_DEVICE_CAP_AP) {
		mode = NM_SETTING_WIRELESS_MODE_AP;
		is_ap = TRUE;
        } else
                mode = NM_SETTING_WIRELESS_MODE_ADHOC;

...

        sws = (NMSettingWirelessSecurity*) nm_setting_wireless_security_new ();
	if (is_ap) {
            wpa_passphrase = generate_wpa_passphrase (device_wifi);
            g_object_set (sws,
                          "key-mgmt", "wpa-psk",
                          "psk", wpa_passphrase,
                          NULL);
            g_free (wpa_passphrase);
        } else {
            wep_key = generate_wep_key (device_wifi);
            g_object_set (sws,
                          "key-mgmt", "none",
                          "wep-key0", wep_key,
                          "wep-key-type", NM_WEP_KEY_TYPE_KEY,
                          NULL);
            g_free (wep_key);
        }

Generating the WPA key is going to be a bit different than doing the WEP key, since a hex WPA PSK is 64 characters long, and that's a b*tch to type.  So you really want to generate a WPA passphrase, which is between 8 and 63 *ASCII* characters long (inclusive).  Probably hit up a dictionary or something?