I've done election clerking, which I highly encourage everyone to do. Here in SF, it's an entirely paper election, and at every precinct there is a ballot scanner. As people fill out their ballots, it gets scanned, tabulated (aka "counted"), then deposited in a locked box that's part of the machine. Your ballot has no personally identifying markings, and is now lost in a pile of other ballots. That is how ballot secrecy works in practice.

At the end of the night, the electronic tabulation is removed from the machine (CF cards), then given in a security sealed bag to a deputy officer who takes it to city hall to be summed up for the results. The paper results are organized, and put in security sealed bags, and given to a sheriff (person with gun), and locked into a van to be transported back to city hall.

So now we have the best of both worlds: fast results, and paper audit trail. Any precinct can be retabulated - just run all the cards thru a machine again. The mail-in ballots are processed separately, and once the envelopes have been verified, the ballots are put thru a tabulation machine as well. My understanding is city hall has a ballot tabulator for every precinct mail-in, and as they process mail they drop them in the appropriate machine. If a mistake was made - it's easily correctable because each ballot has the precinct number printed on it.

It's a very easy to understand system, that requires only basic elements of computer security. Cross checking a ballot tabulator for accuracy is easy. Recounting is easy.

And finally, for accessible voting, people use a tablet to choose their selections, then their ballot is printed out, which contains the summary of the vote, and a QR code the ballot machine scans.

Oh yes, and the ballot machine scans and keeps image files of every ballot. I'm not sure what they do with that, but there we go.

It's fascinating, and my experiences in the SF elections department gives me high confidence that the SF election, and any run like it, are very secure, and accurate.