Doesn't have to be. You can have a system with multiple levels of verification. For example in Canada, each party is allowed to appoint an on-site representati

Doesn't have to be. You can have a system with multiple levels of verification. For example in Canada, each party is allowed to appoint an on-site representative for each ballot box to observe the voting process, the count (and ensure it matches the number of voters and ballot stubs) and the paperwork (a copy of which is sealed in the ballot box which can be unsealed in the event of a judicial recount). Trusting election officials doesn't have to be a passive process like it would be in an electronic voting system.