> you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both

Seems like the obvious solution here would be for the voting machine to generate two separate records:

- A record of the vote itself, without specifying the voter

- A record of the voter having voted, without specifying for whom/what

And of course, if the number of vote records doesn't match the number of voter records, then shenanigans have likely ensued, warranting an election fraud investigation.