Or even just a microsecond emergency.

Bravo

But can't NTP server downtime cause a disaster?

One (amongst many) NTP server going down creates less issues than an NTP server spreading wrong time.

General rule of thumb: a misbehaving/slow server in any well-architected distributed system is vastly worse than a dead server.

technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

> technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

Either go with one clock in your NTPd/Chrony configuration, or ≥4.

Yes, if you have 3 they can triangulate, but if one goes offline now you have 2 with no tie-breaker. If you have (at least) 4 servers, then one can go away and triangulation / sanity-checking can still occur with the 3 remaining.

Your probably meant trilaterate.

Sure, but not needing a failure to cascade to yet another failsafe is still a good idea. After all, all software has bugs, and all networks have configuration errors.

If your application is so critical that NTP timing loss causes disaster and your holdover fails in less than a day and you aren't generating your own via gps, you are incompetent, full stop

And if things are that critical, you might have other references besides just GPS...

E.g.,

* https://www.meinbergglobal.com/english/products/