It's conceivable that you can build a formally verified hardware device that handles the actual voting, and you probably also make sure that the software runnin

It's conceivable that you can build a formally verified hardware device that handles the actual voting, and you probably also make sure that the software running on this device is all signed and authenticated with your trust rooted in hardware. And you can then secure your connection to the voting servers using this hardware device. It would be very expensive, and you still can't be sure you don't have bugs, but it would address a lot of the concerns you're raising.