Re:A paper trail is too insecure. (Score 1)

The "paper trail" can still be anonymous. You can have a machine printout of the actual ballot that goes into the box, without any markings identifying the voter.

There should not be ballot receipts, because that facilitates things like vote-buying (or worse) when someone else can ask to see proof of how you voted.

But you must be able to look at your own ballot and see clearly that it says what you meant it to say (before you drop it in the box) - and any auditor should be able to do so as well on recounts, without any special technical expertise.