How would you design a bootloader for an embedded device that supports safe firmware updates and rollback?