Now explain how that works to non-programmers. You may not hand-wave, you may not ask them to trust a black box, and they must truly understand and trust your system.
And then you can compare that explanation to the explanation for paper ballots, envelopes, and voting urns.
The public's trust in a voting system is a very important feature of that voting system. That the public can participate in voting is also a very important feature. If voting is relegated to a black box that everyone should trust, because, pinky promise, a very clever person designed the black box, then people will stop trusting voting.
I believe a foolproof computer system could count votes perfectly, but it may make our society less stable in the process. Our current population is not ready to understand a fancy computer voting system, and are not capable of distinguishing between a foolproof system and `print "I win!"`.
I currently have to trust a black box whose inner functions are hand-waved away such that I cannot understand it even if I wanted to. Established systems of voting have equally established attack vectors.
If someone cannot understand what a cryptographic hash function does, even if they don't need to understand how, they cannot function in civil society without trusting someone else who can. Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them, with no complaints, and yet while voting once every two years, one of the simplest concepts in all of cryptography is suddenly a problem? It's simpler than Bitcoin. The public can handle it.
They are absolutely part of the voting system currently in use.
I strongly suggest that you follow tptacek's advice in the top comment and volunteer as an election worker a couple of times so you get a feel for how the process actually works.
> Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them
Most people have no idea why or how that is more secure than HTTP, they can't tell the difference, they don't need to know the difference. But the biggest difference is that in online banking or whatever, there are humans who can check if something's gone wrong, if your account has been hacked, you can call your bank and ask them what happened, and you can usually trust them to know what's going on and what went wrong, and you'll get your money back. Or not, and then you can sue them. Either way, it's fixable.
Voting has no authority that can fix things if something went wrong. The voters are the authority, which means that all the voters need to understand and trust the entire system for it to be authoritative.
The black box I am referring to specifically is the optical scan vote tabulator machine that sits between me and the ballot box, in my current polling place. I have seen it multiple times, and examined it to the extent that I am able. When I lived elsewhere, there were different machines. Every one of them has been a black box to the voting public.
I very explicitly do not trust those machines, because I know how the grey boxes that build the black boxes typically work. The publicly available information about them does not inspire trust. They are defective by design, and stink of corruption.
Some places do have trustworthy elections, using publicly-observable hand-counted paper ballots, like in Minnesota; or slightly less trustworthy vote-by-mail for everyone, like in Oregon. Good for them. I have never voted in those places. Bad for me.
And voting does have an authority that can "fix" things. It's usually the secretary of state for the state, then the supreme courts for that state and for the US. I remember when the SCotUS threw the PotUS election to GW Bush by interfering in Florida's lawful elections process. They didn't back up the voters' authority in that instance. I have felt the frustration of statewide elections where I had a sense that someone was dicking with the results, and there was nothing I could do about it without putting so much effort in that I'd be turning elections activism into an expensive, thankless hobby.
I have zero trust in the current US elections process, and never believed that my vote actually counted for anything. I honestly don't know why I keep voting--gesture of defiance, maybe. I think the voting systems in every place I have voted have all been broken, from the enabling legislation all the way down to local procedures at the polling place. First-past-the-post is broken mathematically. Ballot access laws are cheating. Gerrymandered district boundaries are cheating. Restricted primary voting is cheating.
I can't do anything to fix the systemic flaws without spending 20 years becoming the controlling authority of a single-issue political bloc and fundraising it all the way to actual significance, but encryption math and open, publicly-auditable software is a lot less work, and could still help with the local procedures. Of course, we'd also need a trustworthy compiler that can produce bitwise-identical binaries of different machines, and a trustworthy computer to run the compiler on, and some way for the public to verify that the software running during the election is the same software that was compiled at the public ceremony. And then also assume that an attack on integrity might still succeed, and proceed under the assumption that the system is compromised, whether by intentional act or accidental mistake, by auditing the final results in a non-predictable way.
Buuuuuut... it's not really my job to restore trust in the system. That's up to the ones profiting from it. I have named a system that I, personally, could possibly trust. But it will probably not be adopted, because the trust comes from the tamper-resistance, and elections tampering is a feature desired by those currently holding elected office. In my estimation, voting in the US won't be fixed within the next 5 years, because there is currently profit to be taken by keeping it broken.
This key can be used with a personal computer, or public voting computer, each using the same open-source, audited software, to produce a printed ballot with a 2D barcode on it, and a printed voting token with a 2D barcode on it.
The ballot printout can be scanned and verified independently, before casting it, that all the choices are correct. Again, all using the same open-source, audited software as the public vote-recording computers. This printout contains a hash of the voting token. This is so a party can't just print out a bunch of pre-filled ballots, and then hand them out for voters to cast, and also useful for recounts and audits.
A separate printout encodes the voting token. It cryptographically verifies that a registered voter is voting now. The voter registration system associates a different hash of the voting token, a voter hash, with the voter. The voting system can associate the ballot hash of the voting token with the voting choices. If you have a voting token, you can compute the voter hash, look up the registered voter on the voter site, compute the ballot hash, and look up what their votes were on the vote-counting site. You can't tell whether that particular ballot is the one that counts for that voter.
Because up until the end of the election, the voter can also request a new token, which invalidates their previous ballot, and cast a new one. That token will also be associated with their votes and their name, but the official election system knows to count that one, and not another one. Or they can request a "provisional", "test", or "decoy" token, which can be used to cast a ballot that will never be counted.
Anyone that attempts to coerce a voter into voting a particular way, or who tries to pay for votes, can be given a genuine token that is later cancelled, or a dummy token that was never valid to begin with. They have no means of validating if the token represents a vote that counts until after the election is over. At that time, an audit or recount might show that it was a decoy vote. You can't work backwards from a ballot to see who cast it. You can't work backwards from a public voter registration to see how they voted in any election. You can only start from the set of tokens, verify that one belongs to a registered voter, verify that it was used to cast a ballot, and if you also have privileged access to the voter registration system, determine whether or not that token is the single authoritative voting token for that voter in the current election.
In a recount or audit, the voter registration authority consults its database, finds all the tokens valid for a given election, computes the ballot hashes for each, and prints out all the ballot hashes, including machine-readable barcodes. A sorting machine could be loaded with the list, and automatically spit out a pile of ballots to be counted, and a pile of ballots that don't count. Or a human could sort them by hand, by consulting the list of valid ballot hashes, and crossing out the one printed on the ballot they are looking at. Any ballot not on the list, or already crossed off of it, goes in the "don't count" pile. Then, once again, by machine or by human, the ballots in the "valid" pile can be independently counted for the office or issue in question, and compared against the original automated count.
The secret part of this voting system is the secret kept between the voter and the government with respect to "does this specific ballot count or not?".