Incidentally, you just wrote a pretty good argument for (political) voting on paper instead of via machines.

Absolutely. A system you can see and understand garners a lot more trust than a black-box (even if the box runs vetted and open software).

I think the correct solution is a machine that prints out both a human- and machine-readable representation of the vote. The voter can confirm that the human-readable representation is correct, and you can randomly hand-count a few boxes of ballots to check that the hand-count matches the machine-count.

An election doesn't need to be tamper-proof we just need to be able to detect tampering well enough to make tampering a loser's game.

You could do such a hybrid system, but honestly purely paper based systems seem to work well enough in practice. Eg Germany uses paper and human counting, and the results are usually available fairly quickly.

The problem with randomly hand-counting a few boxes of ballots is that you then need to convince people that the random selection was uniform and fair and actually random.

There are methods to do that, but there are at least as complicated and full of cryptographic finesse, that they ain't simpler than vetting an electronic voting system in the first place.

Having said that: human counting isn't fool proof and is still open to abuse and tampering.

It's mainly that any village idiot can in-theory audit the human-run system, and that it would take a conspiracy with lots of people to engage in wide spread tampering.

The more people involved, the harder it is to prevent leaks.

It's not just tampering one needs to worry about with elections. There's also secrecy (to prevent voter coercion).

Right, otherwise the problem would be trivial. If it wasn't clear, the plan was the printed ballot would anonymously go in a box to be machine counted.

Someone could stuff the box with extra ballots?

Yup, but they can do so with old-fashioned paper ballots too. Any security measures for paper ballots will also work with my idea, and the machine could also do fancier things like printing out a timestamp and signature of the timestamp . I really want things to be simple though: if the system of voting is too complex, then it will be distrusted, and distrust in the voting system is toxic to democracy.

What they can't trivially do with any system including paper ballots is remove ballots, compared to digital voting machines where you can add e.g. -100 votes to candidtate A, 100 votes to candidate B, thus ensuring that the total-votes field is correct while advantaging candidate B -- this was actually demonstrated by a security researcher on a Diebold touch-screen machine.

FOIA reports usually have a small textbox over the redacted information with a reference to the reason for redaction, likely made in Adobe PDF. Then the docs are either printed and scanned or just converted to an image only PDF.