Is my understanding correct that it would be sufficient to add NSS_FORCE_FIPS=1 in the %build of nss-softokn.spec?

I have pushed it to rawhide:
https://src.fedoraproject.org/rpms/nss-softokn/c/91a55abc47abb2235559276288ae71b1efc1f454?branch=master
and started the build.

Yes, I think so, sorry for not making that clear immediately.

nss-3.37.3-1.1.fc28 nss-softokn-3.37.3-1.1.fc28 nss-util-3.37.3-1.0.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-38d2c74097

nss-3.37.3-1.1.fc28, nss-softokn-3.37.3-1.1.fc28, nss-util-3.37.3-1.0.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-38d2c74097

nss-3.37.3-1.1.fc28, nss-softokn-3.37.3-1.1.fc28, nss-util-3.37.3-1.0.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

nss-3.37.3-1.1.fc28, nss-softokn-3.37.3-1.1.fc28, nss-util-3.37.3-1.0.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.