Comment by kelnos

I don't think that solves it. In your "example A", the compromised software can display that you voted for candidate A, but when doing the signing, sign the result that you voted for candidate B. There's no reason why the thing that it signs has to be the same thing that you see on the screen, and there's no way for you to verify it.