For anyone else wondering how their clients verify the authenticity of timestamps; It seems they use the NTP server software Chrony, which has support for NTS (Network Time Security, RFC 8915).