What about before the machines are sealed off and air gapped? What stops tampering with the software in advance? As long as something about the configuration lets you know it's a real election, your payload can be triggered.