Ask HN: Have you architected an auto-update feature?

Have you architected the auto-update feature of an application, including the implementation on the client side as well as the infrastructure required at the server side? How did you scale it from a few hundreds of end-users to a few hundred thousands? What were the unexpected problems? Did you make the application contact "updates.<vendor>.com" at random intervals? Did you use anycast? Did you host the infrastructure in different datacenters? How did you prevent bad updates from breaking the auto-update client? I would love to hear answers from engineers having participated in the design of, for example, Windows Update, Google Update for Chrome, or popular antivirus software.