Validating source code does nothing. Even setting aside the fact that firmware and hardware level exploits could be running in any given voting machine, what guarantee do we have that the code in the repository is the code actually running on the machine at the app layer? Or, if you're REALLY security minded like myself, what guarantee do we have that the compiler and build environment didn't slip something in? (I guess that borders more on "paranoid" than "security minded", but you get the idea.)