software that knows how to update itself

[Wayne Pierce]

One thing I would like to add is that you can also restrict what hosts
are allowed to initiate an update.  Perhaps something on the client
that only allows the update request from your machine.

The IP can be forged, so this isn't perfect just another layer.  You
should also have the servers report back when a host tries to initiate
an update, this way you know if someone attempts to update a client.