Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questi

Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questions). We're told every year or so about some SecureBoot vulnerability, which presumably involves code that has been reviewed. The system doesn't only include the code directly related to voting. It also includes OSes and everything involved in the infrastructure for hosting and communication (the Belenios system in particular involves sending private keys by email, and we're also relying on end user systems being uncompromised (who here likes browser extensions?)). It's not feasible to claim that such a system is secure from a remotely controlled attack (eg, by a lone external actor). Most of the attack scenarios against an offline voting system are ones that the general population can at least reason about, and they probably involve multiple insiders that would face a serious risk of being ratted out by one another.