The way this (anonymity) is handled in the Estonian system is that votes can be validated out-of-band for 30 minutes after they were cast, then they're locked.

The way this (anonymity) is handled in the Estonian system is that votes can be validated out-of-band for 30 minutes after they were cast, then they're locked. Additionally, a voter can overwrite their previous vote at any time during the vote period, so they could always prove their first vote, and then overwrite it privately later. There are several other major problems with their system [0], but I think they should at least get credit for their approach. 0: https://www.aaspring.com/ccs2014/ivoting-paper.pdf https://www.aaspring.com/ccs2014/ivoting-paper.pdf