I think this is a hopeless goal, sort of related to Reflections on Trusting Trust. Even the most basic version of this, a ballot-marking system, is pretty much

I think this is a hopeless goal, sort of related to Reflections on Trusting Trust. Even the most basic version of this, a ballot-marking system, is pretty much infeasible unless you have formally verified hardware as well, which is not even possible even for commercial vendors. At least for them, selling sealed units that are somewhat resistant to physical modification is possible, but even there physical compromises have been demonstrated. Ballot scanning machines (for hand-marked ballots) are a pretty good balance of time/accuracy/simplicity, with the auditability being a big bonus for both random checks and for disputed elections. To take New York state as an example, it has manually marked ballots now with ballot scanners for tabulation, and I'm reasonably comfortable with the tabulation and placement aspects; where NY fails is largely in usability -- ballot design is worse than terrible, and borders on misleading. That plus the inscrutibility of NY's ballot initiative system (trying to find the actual text of the ballot measures is nearly impossible) makes the whole system a little shakey. And part of that as well is the scope of elected positions for minor things (what the hell is a Comptroller and why are we voting for one); they basically are a power transfer from the executives to the party machine to allow them to essentially give positions to people favored by the (unelected) party apparatus, which give toeholds to higher positions.