One of the requirements of a good voting system is that it be possible after-the-fact for anyone to prove how a voter voted--even the voter himself. I didn't see how the receipt could proof that a vote was counted without providing proof of how it was cast. The voter knows how he voted, and he verified that the machine correctly recorded his vote by reading the printout before he separated the two laminated layers. Then he can verify that his vote as cast was included in the total (as described in Chaum's paper). But his receipt does not (and cannot) tell anyone else how he voted, just that his vote (whatever it was) was correctly tallied.
I reread Chaum's paper and I'm still confused. What is to prevent the machine from generating four images: top and bottom images that show the voter's real choices, a bottom image which if paired with the "real" top would show a set of fake choices, and a top image which, if paired with the "real" bottom, would show the set of fake choices? Once the voter has selected which half of the ballot to keep, the machine would be able to decide which images it should keep.
Perhaps there's something about the consistency checks I'm not understanding.