You can't do both #1 and #2 now. An anonymous ballot can't be audited, because it has no provenance -- if somebody slips an extra ballot in, how would you tell?
In Denmark you don't know what the ballots look like before election day, so you can't produce them in advance, and they aren't printed on printerpaper but is larger and the paper has a distinct texture/feeling.
The ballot box is made of transparent plastic (something like [1]), and you don't slide the envelope in it yourself. The slot is blocked until an official pulls a lever to let it go through.
So you put the envelope by the slot, if you keep holding it you will be asked you to let it go (so you can't cleverly hold multiple of them while it looks like one). They'll check again who you are and if you can actually vote and so on. If all is good, an official will pull the lever.
[1] https://www.jpg.fr/content/images/product/09812-00J_1_xnl.jp...
And then you have:
- one person who opens the envelope containing the ballot and unfolds it
- one who reads out loud the ballot
- at least two who write down what the person above said
And all that is supervised by the same people who were manning the polling station (at least 4 them).
So if you have multiple ballots in the same envelope, they will call it. The only way it'd work is if they all worked together. And you'd have to do that for a couple counting stations in many given polling stations... That sounds like an inside job you couldn't keep secret for long.
Because one thing I forgot to mention: counting is done at the polling station, it's not centralized, only results are.
If you stake everything you have on the original process being incorruptible, then your only response to an audit that shows a discrepancy must be "the audit is wrong". That's unlikely to satisfy many people; if that is your only strategy for dealing with audits, you are running an inauditable process.