do check dnssec timestamps by default - works fine if you use IP address
for timeserver rather than name.