Any system that allows one to establish that the vote was counted properly cannot coexist with full secrecy of the ballot. We can make a promise that the vote is counted. We can even verify that a particular ballot was marked as counted. But we can't prove that the ballot was counted as written and still maintain secrecy.
The reason should be obvious. If I can verify that I voted for, e.g., Gary Johnson on my ballot, then someone else can use the same verification method to see that I voted for Gary Johnson.
Some of the academic literature is confusing on this point, as they will define either verification or secrecy more loosely. For example, they may provide a decryption key. Without that, no one can check my vote. But with that, anyone can check my vote. The system relies on my control of the decryption key. So a criminal steals my decryption key and knows how I vote. That's an example with secrecy defined loosely.
An example with verification defined loosely would be where I get a receipt that says that ballot #35 was counted. It doesn't say for whom. Great. What does that tell me? Absolutely nothing. I'm still relying entirely on the system to have counted my vote correctly.
A more specific example from Wikipedia:
After the voter selects their candidates, a DRE machine prints out a specially formatted version of the ballot on two transparencies. When the layers are stacked, they show the human-readable vote. However, each transparency is encrypted with a form of visual cryptography so that it alone does not reveal any information unless it is decrypted. The voter selects one layer to destroy at the poll. The DRE retains an electronic copy of the other layer and gives the physical copy as a receipt to allow the voter to confirm that the electronic ballot was not later changed. The system guards against changes to the voter's ballot and uses a mix-net decryption procedure to ensure that each vote is accurately counted.
Note that I can't actually verify that my vote was counted correctly. I can only verify that the system reports that it counted it correctly and that the stored copy hasn't changed from when I cast the vote. If I trust the voting system, then I'm happy. But that's the problem. This doesn't establish trust in the voting system; it requires it.
In a regular voting system, I am also stuck relying on the system.
Alternately, it is apparently possible to decrypt the ballot so as to count it. But this takes us back to the secrecy problem. If the system can decrypt the ballot, then someone else could. This is why passwords are stored as one way hashes rather than encrypted. Encryption is insufficient security.
Even a one-way hash won't work here. It allows exactly what we want to avoid but doesn't allow for counting. If we reenter the ballot, we can verify that its hashed value matches. But we can't count the ballot with it. Because you can't turn a hash into a value, only a value into a hash.
