Well, I was not expecting that to be a multi-hour ordeal but I had a few bugs.
CRC checks added. Next step is probably going to be refactoring the front panel bootloader a bit so that as much as possible of the code is reusable on the main micro as well.
The actual DFU code will be completely different (since I'll be running the sshd on the same chip being flashed) but the basic version/CRC check logic should be the same.
The other thing I need to do is refactor the main MCU code so that it's split into a common bare bones feature set (ssh server and minimal hardware bringup) needed for OTA flashing of the main MCU, and then the full feature set for all other functionality.