The voting system sends out postcards to registered voters with a temper-evident scratch-off covering, over a private key. This key can be used with a personal

The voting system sends out postcards to registered voters with a temper-evident scratch-off covering, over a private key. This key can be used with a personal computer, or public voting computer, each using the same open-source, audited software, to produce a printed ballot with a 2D barcode on it, and a printed voting token with a 2D barcode on it. The ballot printout can be scanned and verified independently, before casting it, that all the choices are correct. Again, all using the same open-source, audited software as the public vote-recording computers. This printout contains a hash of the voting token. This is so a party can't just print out a bunch of pre-filled ballots, and then hand them out for voters to cast, and also useful for recounts and audits. A separate printout encodes the voting token. It cryptographically verifies that a registered voter is voting now. The voter registration system associates a different hash of the voting token, a voter hash, with the voter. The voting system can associate the ballot hash of the voting token with the voting choices. If you have a voting token, you can compute the voter hash, look up the registered voter on the voter site, compute the ballot hash, and look up what their votes were on the vote-counting site. You can't tell whether that particular ballot is the one that counts for that voter. Because up until the end of the election, the voter can also request a new token, which invalidates their previous ballot, and cast a new one. That token will also be associated with their votes and their name, but the official election system knows to count that one, and not another one. Or they can request a "provisional", "test", or "decoy" token, which can be used to cast a ballot that will never be counted. Anyone that attempts to coerce a voter into voting a particular way, or who tries to pay for votes, can be given a genuine token that is later cancelled, or a dummy token that was never valid to begin with. They have no means of validating if the token represents a vote that counts until after the election is over. At that time, an audit or recount might show that it was a decoy vote. You can't work backwards from a ballot to see who cast it. You can't work backwards from a public voter registration to see how they voted in any election. You can only start from the set of tokens, verify that one belongs to a registered voter, verify that it was used to cast a ballot, and if you also have privileged access to the voter registration system, determine whether or not that token is the single authoritative voting token for that voter in the current election. In a recount or audit, the voter registration authority consults its database, finds all the tokens valid for a given election, computes the ballot hashes for each, and prints out all the ballot hashes, including machine-readable barcodes. A sorting machine could be loaded with the list, and automatically spit out a pile of ballots to be counted, and a pile of ballots that don't count. Or a human could sort them by hand, by consulting the list of valid ballot hashes, and crossing out the one printed on the ballot they are looking at. Any ballot not on the list, or already crossed off of it, goes in the "don't count" pile. Then, once again, by machine or by human, the ballots in the "valid" pile can be independently counted for the office or issue in question, and compared against the original automated count. The secret part of this voting system is the secret kept between the voter and the government with respect to "does this specific ballot count or not?".