Here's how I might do it (but I'd also open this up for discussion, since I can't think of every potential problem with it).

In Georgia (yes, I know, bad example, considering), you selected the candidates from a touch screen, and a printer printed out a single human readable copy that you inserted into the scanner that tallied and (supposedly) also retained the paper copy. The candidates you voted for were printed in regular text so you could verify them before inserting it into the scanner. The touchscreen and printer were obviously connected to each other, but were not (supposed to be) connected to the scanner.

A big problem for me was that the touchscreen/printer combo also put a QR code on the printed ballot which was not human readable - it was supposed to match, but no one could be sure they did. And the QR codes were what was being counted. I don't think the touchscreen is a problem in and of itself, except for generating the QR codes.

The printer could instead print two copies without a QR code, but with some kind of unique identifying number (identifying the ballot, not the voter, as votes are supposed to be anonymous) - maybe the date, time in HH:MM:SS, location code for the poll, machine number at the poll - so ballots could be matched to their twin if necessary.

Then one gets put in the official traditional locked ballot box, and one goes home with the voter. I'd eliminate the scanner/counter completely, unless the scanner were solely for the purpose of documentation and didn't count votes.

Counting would have to be done by hand by sorting into stacks, and maybe have a machine to count the number of pieces of paper, but that would need to be strictly monitored.

In the event of a recount, everyone who wanted to make sure their vote was recounted would need to return to the polling place and allow a copy to be made of their votes, and placed into a traditional locked box for the recount.

For elections in which there were multiple races (President/VP, Senate, House, Local stuff), you'd need to have a separate piece of paper and a separate ballot box for each race, I guess (to make handling and counting more secure and simplified).

Here's how I might do it (but I'd also open this up for discussion, since I can't think of every potential problem with it).

In Georgia (yes, I know, bad example, considering), you selected the candidates from a touch screen, and a printer printed out a single human readable copy that you inserted into the scanner that tallied and (supposedly) also retained the paper copy. The candidates you voted for were printed in regular text so you could verify them before inserting it into the scanner. The touchscreen and printer were obviously connected to each other, but were not (supposed to be) connected to the scanner.

A big problem for me was that the touchscreen/printer combo also put a QR code on the printed ballot which was not human readable - it was supposed to match, but no one could be sure they did. And the QR codes were what was being counted. I don't think the touchscreen is a problem in and of itself, except for generating the QR codes.

The printer could instead print two copies without a QR code, but with some kind of unique identifying number (identifying the ballot, not the voter, as votes are supposed to be anonymous) - maybe the date, time in HH:MM:SS, location code for the poll, machine number at the poll - so ballots could be matched to their twin if necessary.

Then one gets put in the official traditional locked ballot box, and one goes home with the voter. I'd eliminate the scanner/counter completely, unless the scanner were solely for the purpose of documentation and didn't count votes.

Counting would have to be done by hand by sorting into stacks, and maybe have a machine to count the number of pieces of paper, but that would need to be strictly monitored.

In the event of a recount, everyone who wanted to make sure their vote was recounted would need to return to the polling place and allow a copy to be made of their votes, and placed into a traditional locked box for the recount.

For elections in which there were multiple races (President/VP, Senate, House, Local stuff), you'd need to have a separate piece of paper and a separate ballot box for each race, I guess.