> The easy way would be to pick out a limited subset of votes and require voters to produce the receipts for them. It's not ideal since this makes the system more complicated for voters and voters are forced to use fake ballots if you want plausible deniability, but it works.
What happens when some of the voters fail to produce the receipts? This seems inevitable even assuming good faith, but especially if it could be used to cast doubt on the legitimacy of the winning candidate (and it wouldn't even require voting against one's real preferences, given the existence of 'fake votes' in this system). Just deleting the unverified votes won't achieve much, if only a small subset are being tested.
What happens when some of the voters fail to produce the receipts? This seems inevitable even assuming good faith, but especially if it could be used to cast doubt on the legitimacy of the winning candidate (and it wouldn't even require voting against one's real preferences, given the existence of 'fake votes' in this system). Just deleting the unverified votes won't achieve much, if only a small subset are being tested.