Yeah, there's a fundamental tension between secrecy and verifiability. The main way I've seen this resolved is immediate verification, eg displaying the vote in a paper receipt kept by the elections board for recounts.