> Think of the On Trusting Trust problem, the need to verify firmware, etc.

I mean that's too abstract and philosophical of a problem when talking about voting machines/software: there are much more prevalent and concrete risks including but not limited to APT-grade breach/espionage if your country is important enough, and the various other issues (some in your comment itself).

Yes, of course. See my reply to sibling comment about why a software solution is insufficient, even a soft/hardware solution is insufficient. Cryptography does not save the day. A modicum of physically auditable paper trail is required.