> Because there is no digital equivalent to the one-way hash of dropping a ballot into a ballot box.

This is equivalent to preventing double-spending in the blockchain analogy - a solved problem. There are already companies trying to exploit this to develop electronic-voting systems: https://followmyvote.com/.

I imagine it working like this:

1. Government announces an election. Registered voters are asked to submit the public addresses of their 'vote wallets'. The public addresses of the wallets are derived from the registered voter's public information (e.g. their name). This information need not be secret. The public blockchain would ensure that everyone who is registered received their votes to cast: the equivalent of receiving an empty ballot paper.

2. A Monero-like system (confession: I don't fully understand it yet) acting as a blackbox or Bitcoin-tumbler system then distributes empty-ballots from the public wallets into new private wallets that each registered-voter will have created in an anonymous fashion.

3. Registered voters then cast their votes by 'spending' their ballots (coins) by sending them to the public wallets of electoral candidates. These transactions may be cryptographically signed by a private key derived from the registered-voter's public wallet. This allows a voter to verify that their vote was correctly cast, without allowing others to see whom they actually voted for.

4. There is a problem in that the results of the election cannot be kept secret until the election is over, as the blockchain must be distributed publicly, so observers will see the votes going towards a particular candidate as-they-happen, which will necessarily change voters' votes in cases of tactical-voting; though possible solutions exist, such as having blockchain network nodes agree to only allow final vote transactions during a tiny time window of only a few seconds - or a Proof-of-Work system that will necessarily take more computation time to verify a vote was for a particular candidate the more in-advance of the polls-closing deadline the vote was made.

Because votes cannot be 'mined', and all originate from a single 'government wallet' it means that votes cannot be manufactured - as far as I can tell the only weakness is that false voter-registrations could exist and be used to cast votes, but then we have that situation with postal-voting now any way. If a tumbler approach is used to distribute ballots from public wallets to private wallets it's possible for participants to create more than one private wallet, and claim more ballots for themselves - but this can be detected by:

1. As part of step 1 above, voters create a private secret K.

2. Each voter then creates a hash of K, known as K'.

3. The blockchain would also contain a Bloom-filter, or equivalent implementation of a "Set contains a member" test that does not reveal the actual set contents. Then a strictly sequential process begins, where the Bloom-filter is publicly modified by each registered voter to add their own K' values - this necessarily means that the K' values of the first voters will be publicly known entirely, but as the table becomes more populated it will be impossible to fully know what the entire values of each K' value is. This can be mitigated by having the system create known 'sacrificial' / dummy voters to provide some initial protection for the first actual voters.

4. When the private wallets are created by each voter (in step 2 above) they must be tagged with the K values each voter created as Kp. A private wallet will only be able to participate in the ballot distribution process if the hash of its Kp value (Kp') appears in the Bloom filter populated in the previous step) - thus restricting each voter to only 1 private ballot wallet.