Currently I believe ntpd-rs is missing an option to disable cert time checking in NTS.

Devices without a RTC will boot with invalid date which will fail NTS cert time checks. chrony has a possibility to set nocerttimecheck 1. Could be done with some harm reduction - multiple sources would need to initially serve the same time, after getting a consensus on the initial time, create a "lockfile" so after restart/crash it still does cert time checks properly.