For those proposing solutions to problems that may not actually exist, here's an idealized paper ballot chain of custody, in story form... A ballot is printed.

For those proposing solutions to problems that may not actually exist, here's an idealized paper ballot chain of custody, in story form... A ballot is printed. It is then packaged, along with many of its siblings, in a stack. That stack of ballots is placed in a sealed package, and that package is given a serial number. The state election officials receive this sealed package from the printer and record its serial number. It is then put in locked storage. At election time, the package is taken from the warehouse and delivered to a polling place. At the polling place, at least two election judges, from different political parties, accept the package and sign for it. The package is taken to a table staffed by at least two election judges, along with folders, pens, and "I voted" stickers. It is opened, the contents validated, and custody signed off by those judges. Another table has printed rolls of all registered voters for the precinct, and at least two judges. When a voter arrives, they give their name (no id needed), and the judges look them up. They sign their name next to their registration, and go to the ballot table. Meanwhile, the judges increment the count of how many voters have signed in. At the ballot table, our ballot (remember our individual ballot?) is handed to the voter in a folder, along with a pen and a sticker. The ballot is now in the custody of the voter, who signed for it in the registration book. The voter goes to a booth, fills in their ballot, and inserts it in a ballot box. (This may be a Scantron-type machine that also reads the ballot.) Assuming automation, the box reads the ballot, tallies the results, and drops the ballot itself in a locked internal box. At the end of the day, the judges write down the total number of ballots in the machines. They compare this to the number of voters who signed the registration. If these numbers do not match, these results are hand-counted again. Assuming everything matches, the judges report the preliminary results from the machines (or if they are not machines, the judges count the results of the ballots). The locked ballot boxes are removed from the machines by at least two judges, and signed off. Unused blank ballots, both opened and sealed, are also counted. The locked ballot boxes are then delivered to state election officials, who sign off on receipt. In case of an audit or a recount, each box can be traced to the individual machine and compared to the machine count. So... what security problems do you see with this model? And what solution do you propose for the problem you see?