Can it be anonymous though? Ie you as a citizen can check that the outcome didn't count illegitimate votes, and that it included your vote, but can't tell who voted each way or at all.

Yes, it is possible to anonymously aggregate votes from a set of public keys, and ensure that no key has voted twice. It's also possible to ensure that one's own vote was included in the total.

The fact that this is even possible is deeply un-intuitive as it requires some of the most sophisticated cryptography. That's probably the greatest barrier to adoption. When people think of electronic voting, they think about trusting a company to make machines that operate on plaintext, and require humans to guard access to the machines. They aren't thinking about systems that are provably correct, where it is more likely for an asteroid to wipe out the country conducting the election than for the election results to be incorrect.

For the details and tradeoffs, I highly recommend Vitalik's blog.

The problem is ensuring that the set of allowed public keys you have is actually the set of allowed public keys you want.

As others in the thread have said, there's nothing stopping the government from manufacturing millions of fake passport (or even just generating millions of fake passport keys) and using them to rig the election.

For the purposes of this, I was assuming 1:1 passport to citizen and just wondering if that can be made anonymous. The real idea with an untrusted passport authority doesn't work ofc.

hence why

>You probably wouldn't want to use the cryptography on the passports themselves to implement the voting system. You probably want to use one of the general purpose zkSTARKs or multi-party-computation systems.

Even if you're using a separate key for voting, the passport key had to sign it. How do you prove legitimacy of the voting key without exposing the passport key? It's not like in blockchain where your anonymity normally comes from people just not knowing which irl person owns a pubkey. (Though I know Monero etc use homomorphic enc for anon payments)

I'm also assuming here that the govt is signing all the passport keys, cause idk how else that would work.

This seems like navel gazing. Under OP's constraints it wouldn't matter what the tally is. The authoritarian won't cede power because they lost by a cryptographically secure election. They'll either

A. Force the cryptography to be weak to provide plausible deniability

B. Issue more passports for "citizens" that "voted" for them

C. Refuse the count and just keep power

Leaders don't cede power because their citizens are angry. Especially not in authoritarian countries.