I must be missing something. I do not grasp why the SP cannot be assigned a hash that allows a) public verification that it has been used to vote - but not how it voted, b) prevents it being used to vote again for that election, and c) can either be used to change one's vote later, permitting 'liquid democracy' and folks to change their mind after discovering unsavory facts post-election, or terminate upon conclusion of the plebiscite.

A hash is fairly easy to construct that allows your item 1. Why is 2. even desirable?