Anonymous Voting and "Vote By Mail" systems

Vote By Mail seems to be a pretty good idea in most respects. But if you look at the manual from Oregon you'll note that the ballot isn't really anonymous; the procedures for opening a ballot (p. 71) have the same person (or group of persons) opening both the outer envelope and the secrecy envelope, providing all the information required to attached an individual to their vote. A better way to handle this would be to separate the opening of the outer and inner envelopes. Have one "opening board" open all of the outer envelopes and then dump the inner envelopes into a big tub or something. Ship the tub to a second board, and have them open the inner envelopes. This process effectively destroys the relationship between the outer and inner envelopes, thus preserving anonymity while still allowing vote verification. Though, as a side note, voting by mail will never really be truly anonymous, because a verifiable ballot sent through the mail (at least as currently instituted) contains both ballot and identifying information. It will still be possible for someone to associate your identity with your ballot if they are willing to violate election procedure.