> A well-established consensus isn't just about how many people believe it, it's about why they believe it, the observations and reasoning behind it, and to some extent the depth of any relevant domain expertise in approach the problem and formulating the conclusions.

Ok, let's apply this to, say, this claim at the start of the paper:

"In states such as Georgia, paper records and auditing procedures made it possible to verify the count’s accuracy."

What does "verify the count's accuracy" actually mean? It means that, when you manually count up the votes on the paper ballots, the count matches the original count that the machines gave.

What it does not mean is that it has been verified that every single paper ballot corresponds to an actual eligible voter and accurately reflects that voter's intent. Our system makes it impossible to audit that after the fact; we purposely destroy that information as soon as a ballot is put into the system. And that is where the problem lies; when neither side trusts the other not to attempt to cheat in any area where it's impossible to audit after the fact, the only way to have a really secure and acceptable voting system is to not have any such areas.

If we want to maintain secret ballots (which I agree is a good thing to maintain), then the best way to verify that every ballot put into the system corresponds to an actual eligible voter and accurately reflects that voter's intent is to have the voter vote in person, have their identity and eligibility to vote verified, preferably by agreement among representatives of all parties running candidates in the election, keep a record of that verification process for every voter, and then have them cast their ballot and have it checked for accuracy (so they can discard it and try again if there's an error) before it is put into the system and enters the chain of custody for paper ballots (which no longer have any link back to the voter who cast them). Which means that every voter who is physically capable of voting in person should do so. (Note that this does not mean they need to do it on the official "election day"; we should have early voting, preferably starting at least a month before election day, everywhere. For extra points, all candidate debates and any other events the voters might use to make decisions about how to vote should happen before early voting starts anywhere; and for even more points, all election ads, editorials, opinion pieces, and any other election-related reporting other than straight factual information about when the polls are open and where to go to vote, and when the vote counts will be complete, should be prohibited from the first day early voting is allowed until all the votes have been counted and all election results are decided.)

For people who absolutely cannot physically vote in person, the next best way to verify their ballot is to have a group of election workers, one representing each party running candidates in the election, go to that voter's residence (or whatever other place they are voting from), verify their identity and eligibility to vote, keep a record of that verification process, and have them cast their ballot, have it checked for accuracy, and have it put into the chain of custody then. No jurisdiction that I'm aware of even tries to do anything like this. But any other method of so-called "verification" is so obviously hackable that no election system with any pretense to security should even consider it.

For people (such as military deployed abroad) who absolutely cannot be reached by local election workers, mail-in absentee ballots are the only option; but the ballots should be contained in an extra envelope which, on the outside, is signed by the voter and notarized (meaning that a notary public has verified the identity and eligibility to vote of the voter). That envelope then goes inside the mailing envelope and the whole thing gets sent to the appropriate address. I would have no problem with having special mailing envelopes for ballots, provided by the post office and with postage prepaid, that are marked to ensure tracking (so the voter can have evidence that their ballot was properly mailed) and priority handling. When the ballot is received, the signed and notarized envelope becomes the record of the verification process, and the actual ballot gets put into the system (at which point it is no longer linked to the voter who cast it).

Of course all this is light-years away from any proposals on the table for the US voting system. But if we want to really have a secure system that everyone can believe in, this is the sort of thing we need to do. So when I see nothing like this being done or even discussed, it tells me that most people don't really want a secure system. I'm particularly surprised to see Bruce Schneier, who should know better, not even trying to propose anything like this.