How can the contents be confirmed and by whom? It would take a programmer familiar with the language of the "code" cartridge who also has full knowlege of further 'instructions' that might be on the microcontroller board. That isn't a very transparent system to the average poll worker and one that is full of opportunity for whoever might wish to have a leveraged affect on the electoral process.
A digitally-signed copy of the contents is posted on the web for anyone to archive and examine. While a comparatively small number of people would have the expertise to make head nor tail of such a thing, a copy posted on the web could be inspected by people the world over.
As for ensuring that the particular cartridge matched the publicly-posted web copy, the judge from each party would plug the cartridge into a reader device and check.
The reader device could be constructed quite simply and cheaply, using readily-available plans and open-source software. The software could be written so that no particular technical expertise would be required for use in the field. Some expertise would be required for setup, but not too much.
Proposed method of use: each machine is pre-loaded with the proper pre-election ballot images, a list of public signature keys for the opposing party, and a private key for its owner's party. Before the election, the judges will insert the write-protected cartridges into their machines which will indicate whether they match the pre-loaded images. After the election, the judges will connect their machines together and insert the cartridges into each machine in turn. The two machines will communicate via an established protocol and digitally sign copies of the cartridges. Each machine will also check the validity of the other's signatures.
As a backup, it would be recommended that the judges bring printers, so that paper copies of the data could also be signed.
Doesn't seem too hard to me.