What you describe is the ballot-permit system currently in use in many jurisdictions (terminology varies, and the permit may be called an application to vote, v

What you describe is the ballot-permit system currently in use in many jurisdictions (terminology varies, and the permit may be called an application to vote, voter authorization, or similar). The difference is that the ballot information is not published. There are two reasons for this: 1) Current election systems, with few exceptions, do not retain per-ballot voting information, only tallies. This is in large part a practical matter, ballots go through various channels of handling including exceptional cases (e.g. hand entry of damaged ballots) and many of these paths become much more complicated if you need to electronically record the individual selections on each ballot. 2) The risk of re-identification of voters to ballots is high and extremely difficult or impossible to satisfactorily resolve. There are many, many potential ways to establish which specific ballot was cast by a given voter. This is especially important considering that in many elections the number of voters per ballot style (which may be equivalent to a precinct in your area, the exact combination of questions which appears on the ballot based on voter location and potentially party affiliation) will often not be very large, even in densely populated areas, because of course as the area becomes more densely populated the electoral precincts become smaller. Finally, your step 2 is quite unnecessary for current purposes, the physical possession of both the ballot and permit are sufficient to prevent overvoting. One permit entitles an individual to cast one ballot. In the case of mail-in voting the ballot is sealed inside of the permit in a tamper-evident fashion (the outer envelope serves as permit). It also presents a more complicated and worse privacy proposition than the existing system, as the ballots can be post facto linked to the permits and someone could have (likely did) observe the voter take the permit. In current practice ballots cannot be linked to permits after they are physically separated when the voter casts their ballot. This protects the voter by reducing the time period during which their ballot can be identified.