Thank you for the question.
Estonia is a much smaller country. I'm a social scientist, so I can only speak to the security a little bit from what I've studied, but they have a really robust system in place in terms of authentication. Since 2013, they've been working on verification as well.
You mentioned electoral integrity. There have been a couple of instances in which the integrity of elections in Estonia has been called into question, and I think they are important to highlight. One was in 2011, when a student claimed that he could tamper with the system by using election-rigging malware. Around the same time for the same election—but they don't think it's related—one vote was declared invalid during tabulation. They investigated this vote and what might have caused it, because someone could theoretically cast an invalid vote. No bugs were identified.
On the student issue, he wrote to the National Electoral Committee and to three major newspapers, and it eventually went to the Supreme Court, which dismissed the appeal, arguing that although the student was an Estonian citizen and could be subject to voter disenfranchisement attacks, he knowingly put the malware on his own computer and his rights were not violated. Shortly after that, one of the other political parties also filed an appeal to dismiss all of the votes in the election, and that was also dismissed by the Supreme Court.
Around the same time, Estonia started to approach the 25% mark in terms of votes being cast online, and that also raised concerns. When you have more than 25% of the votes being cast online, arguably there's more incentive for someone to try to tamper with the election. The vote share in terms of online voters has continued to increase, and they have not had any issues.
Based, however, on this incident, they worked toward verification. There are different types of verification, but basically the simplest kind is for you to be able to verify that your vote has been cast as you intended. Universal verification is considered the best, and that's cast as intended, recorded as cast, and then counted as cast.