How can the voter be sure that their vote was recorded exactly as they cast it?
Decrypt the confirmed vote with the published public key. This does point to the issue of just how far one has to go to assure a reasonable degree of security. After all, voters have faith that once they press their old-fashioned levers and pull the curtain bar, that their intent is properly recorded. As with lever-type devices, if all machines adhere to strict manufacturing, testing, and administrative regulations and oversight, at some point voters must have faith that when they press the confirm button, their vote has been properly recorded. Indeed, even Open Source designs require protocols for maintaining system integrity.
