@lxo I am not sure how the signature checking is done with Linux (2002 was a Windows CE machine) but they all have TPMs now and the BIOS can check the signature of a first stage boot loader since 2002. If you can boot arbitrary code *and not be detected*, then any voting machine is doomed.
You are focusing too much on the machines themselves and ignoring all the precautions around their storage and handling, the multiple tamper-proof seals, the chain of custody controls...