I wonder what an ideal solution might look like. I kind of envision the Federal government funding a small organization overseeing an open source "election software" system, which would be run on some sort of well-defined stock hardware. The government would periodically pay for the hardware and software combination to be audited against a variety of attacks. The machines would produce standardized audit logs, published as openly as possible (someone smarter than me should figure out whether it's safe or good to publish the times or votes or the votes themselves. I'm leaning towards yes to both, but I'm concerned that you could figure out someone's vote if you knew the timestamps of the individual votes). Security researchers could purchase the hardware, install the software on it, and analyze it on their own. Then you'd do the same thing for the vote tabulators or whatever hardware and software exists asides from the voting machines themselves.

Then I think about what might look like a nice halfway point. Voting machine software is still written by companies, but we require that all software running on a voting machine be published and hermetically reproducible. They don't have to take pull requests, they still own it, but we should be able to open one up and be 100% sure that the software running on it is exactly what they've documented.