Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they

Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.