Out of curiosity, where on the actual website is the crypto code? (It's way harder to follow than your simplified version :) )

Also how are they distributing the initial hash - physical signs? I figure the easiest threat from Spain is to get people to show up to the wrong polling stations, which don't have them on the voter rolls, and then cast doubts on the validity of a referendum that has a huge number of provisional ballots. Since you don't actually need to staff polling stations, this attack only really requires a single person setting up a cloned website and distributing a different hash (although it gets easier if e.g. the postal service is willing to help you send out the wrong hash).