I've tried this on 4 different computers with 4 different Wifi chips in them.
The Wifi works as client, it even works as a access point, if I don't require a password.

However this doesn't work.

nmcli con add type wifi ifname wlp3s0 con-name wlp3s0 autoconnect yes ssid (SSID) mode ap
nmcli con mod wlp3s0 ip4 ipv4.method manual
nmcli con mod wlp3s0 802-11-wireless-security.key-mgmt wpa-none
nmcli con mod wlp3s0 802-11-wireless-security.psk (PASSWORD)
nmcli con mod wlp3s0 ipv4.ignore-auto-dns yes
nmcli con mod wlp3s0 wifi.band bg wifi.channel "11"

If I leave out the two "wireless-security" lines, I can connect (insecurely)

I've also tried using ipv4.method shared (without setting ipv4.addr as static)
I would really like to use this with dnsmasq.
I've tried both having systemd start dnsmasq, and having dnsmasq disabled in systemd, and confuring it to run in NetworkManager.conf

wpa_supplicant has to be running, or nothing works (NetworkManager doesn't support iwd yet?)
The NetworkManager-wifi package is installed.

Has anyone gotten a secure AP (hotspot) to work in Fedora 30?