And yet somebody who voted said far above in this thread that the machine reads a barcode on their ballot, so they have 0% chance of verifying if their vote was entered correctly. And there is always the added problem of a dieselgate style obfuscation: The machine counts votes differently when in verification mode than in actual vote counting mode.

My preferred machine would be one that did not use integrated circuits, but was simple enough that the entire board and circuit was visible - with no software beyond the circuitry at all. You just need a very simple sensor and tally wheels that mechanically advance, like those used for measuring wheels etc. No need for memory. Keep automation to the absolute bare minimum.

Of course it's important that enough people check their ballot and say, "hey this isn't what I meant" it triggers a formal audit. Not just letting those 1000 have a redo and chalk it up to human error.