Hi
On Linux (Ubuntu) I had just installed Chrony and entered server time.cloudflare.com nts to /etc/chrony/chrony.conf
This forces system to ask time via NTS (TLS) so nobody can intercept or spoof it.
The main question:
How can I do something similar on my 24.10.3 (r28872-daca7c049b)
Firmware link
GL.iNet GL-MT3000
you should install chrony-nts which contains "full" set of features like found on non-embedded linuxes
You have to disable service sysntpd before other NTP service can go ahead.
before or after install luci-app-attendedsysupgrade and upgrade to 24.10.4 
Note that NTS protects from your provider close to home sabotaging NTP, you still need multiple alternative time sources to elect correct time trend.
server time.cloudflare.com iburst nts
server ntppool1.time.nl iburst nts
server nts.netnod.se iburst nts
server ptbtime1.ptb.de iburst nts
server time.dfm.dk iburst nts
server time.cifelli.xyz iburst nts
Will this be enough?
Yeah. It's time to. I just afraid to brick router, since I have no devices that support LAN port. But I think I should have been already purchased external adapter 
A little dumb question: won't this conflict with NTP settings in LuCi?
Anyways, many thanks for your help!
chronyd has no relation with luci settings for sysntpd.
Here they recommend having four servers:
You should consider server accuracy or stratum when building your list.
Have a play with luci-app-chrony
luci-app-chrony depends on regular chrony which conflicts with chrony-nts
Add here provides chrony line to satisfy luci app requirement @mlichvar - will it work?
I don't know, I'm not very familiar with the dependency resolver. If a newly installed package has a dependency on chrony and neither variant is installed, would the resolver prefer the non-nts variant, or select it randomly?
totally works.... just that opkg selects candidate at random
> opkg install luci-app-chrony
Installing luci-app-chrony (25.299.71202~85db833) to root...
Downloading https://downloads.openwrt.org/releases/24.10-SNAPSHOT/packages/aarch64_cortex-a53/luci/luci-app-chrony_25.299.71202~85db833_all.ipk
Installing libgmp10 (6.3.0-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10-SNAPSHOT/packages/aarch64_cortex-a53/base/libgmp10_6.3.0-r1_aarch64_cortex-a53.ipk
Installing libnettle8 (3.9.1-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10-SNAPSHOT/packages/aarch64_cortex-a53/base/libnettle8_3.9.1-r1_aarch64_cortex-a53.ipk
Installing libgnutls (3.8.5-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10-SNAPSHOT/packages/aarch64_cortex-a53/packages/libgnutls_3.8.5-r1_aarch64_cortex-a53.ipk
Installing chrony-nts (4.6.1-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10-SNAPSHOT/packages/aarch64_cortex-a53/packages/chrony-nts_4.6.1-r1_aarch64_cortex-a53.ipk
Configuring libgmp10.
Configuring libnettle8.
Configuring libgnutls.
Configuring chrony-nts.
Configuring luci-app-chrony.
NTS option displayed prominently by default (you have to use actual nts server, not pool one)
Tested. Yeah. It works. So thats it? Or I need to change native settings to point something to chrony?
I’ve submitted a PR to main which should fix the provides.
If you want NTS - you need chrony-nts, and check the NTS box for a pool. Refer to the linked documentation in the GUI if you’re unsure. That’s what it’s for.
You have to remove all ntp servers and replace them with nts servers
Leave ONE pool entry though - nts needs valid https: key set and correct time in advance....
On OpenWrt chrony will ignore cert time for the first query if RTC doesn’t exist
