I suppose (1) could be set by solved by having an environment variable where a server can be nominated as the "update server" but this has the down side of it still being possible to accidentally have multiple marked servers.