What are the security flaws of this voting system ?
Let's say one month before the elections an offline machine auto-generates sealed envelopes for each voter which contain 3 unique GUID codes. The envelops are sent by mail to voters.
If a voter signs for receiving the envelope he can participate only in online voting. If he doesn't then he can only participate in offline voting.
The machine drops the codes for the people who did not sign and releases their voter identities for the offline vote. At this point the machine deletes the voter identity to ensure vote secrecy. The only place which still associates vote identity with the codes is the envelope found in possesion of the voter.
In voting day the user provides code 1 and the site answers with code 2, proving that it is not hacked. Then user provides code 3 which proves to the site that the user is legit. Then user can vote. The vote is associated with code 3, NOT the voter's identity, which does not even exist on the server.
The user can at any time check it's vote to see it's correct. If it's not (for whatever reason) he can go with the envelope (which has hard to reproduce security marks-like money) to a regular voting place, where his electronic codes are canceled and he can do a normal vote.
When the voting is done the machine publishes the full list of codes (the 3rd ones) and also the full list with all the codes that have voted. That way anyone with a bit of excel/data analysis knowledge can check that there are no extra codes , and count the results, acting like an observer.
PS. Of course all other security measuers still apply: a VPN room for every town, voters receive a CD/DVD with a dedicated secured virtual machine with the VPN preconfigured, etc