Even simpler than that. I just call it 'decoupling'. The ballot is verified and hashed using Opentimestamps for everyone to see. The userid and ballotid together are only known to the voter.