Ballot Secrecy and an Auditable Paper Trail