> In short, a+b can overflow, but a-b cannot?

I think it's more that by always checking the elapsed time against `now() - starttime`, you never need to represent the time at which the timeout should happen - which may be so far in the future that it causes a signed overflow.