Here's one way to do it that requires basically zero trust in the software: 1) When voters enter the booth, they throw a large number of multi-sided dice. 2)

Here's one way to do it that requires basically zero trust in the software: 1) When voters enter the booth, they throw a large number of multi-sided dice. 2) The resultant throw is scanned via computer-vision. Voter verifies it is correct, and it becomes the voter's ID. Voter votes normally and the vote is recorded alongside that generated "ID". 3) The voter receives a print-out that contains their (ID, vote), however it is randomly shuffled in among other real (ID, vote) pairs. The print-out is guaranteed to have at least one vote for each candidate. 4) The entire list of (ID, vote) pairs can be published nationally. Everyone can verify that the right number of votes were counted, and that their vote was accurately counted since they can find both their ID and vote in the national list. They can show their receipt to others but cannot prove which one of the many IDs on the receipt was actually theirs.