Verify 0xE9 magic byte on first write, verify entire image before switching. Enable verification for secure boot signature (was using invalid ifdef guard)