在「NTS is now an RFC」這邊看到 Network Time Security 成為 IETF 的標準了：「Network Time Security for the Network Time Protocol」。
這個標準比較特別的是，因為 TLS 裡對 certificate 的驗證需要先有正確的時間，而導致 NTP 直接套用 TLS 會有「先有雞還是先有蛋」這樣的問題出現。這點在「8.5. Initial Verification of Server Certificates」這個章節裡面被討論到：
However, the expectation that the client does not yet have a correctly-set system clock at the time of certificate verification presents difficulties with verifying that the certificate is within its validity period, i.e., that the current time lies between the times specified in the certificate's notBefore and notAfter fields.
看起來還是頗複雜，但至少先給個方法出來了...