You are missing something. The envelope comes in. A person checks that the signature on the envelope matches that of the person the ballot belongs to. If they m

You are missing something. The envelope comes in. A person checks that the signature on the envelope matches that of the person the ballot belongs to. If they match, the envelope is opened and the interior sealed envelope is removed. This interior sealed envelope contains no identifying information. That interior sealed envelope is mixed in with all the rest of the interior sealed envelopes (hundreds of thousands to millions of envelopes) so there is no way to identify which ballot belongs to whom. Then the interior sealed envelopes are opened, the ballots are extracted and scanned. All of this is overseen by observers and you can go and watch it if you want.