The switch contains a lot of hardware fuses, with an instruction to blow one.
IIRC it's used (among other things) to set a minimum firmware revision - after upgrading to a new (signed) firmware it blows a fuse so you can no longer run an older signed firmware, which stops you rolling back to when a vulnerability still existed.
Not exactly, but it can be used to prevent you from running custom firmwares or reversing an update. On the Switch, each update would burn a physical fuse on the board, giving the OS a reliable way to determine what the latest update that Switch received was. Prior firmwares cannot be booted on a device with too many fuses burned, which is why the "1.0.0 Nintendo Switch" is going to become an increasingly hot commodity in the coming years.
