Let's all use tlsdated instead of ntpd.

This service script has no config options; everything can be set in
tlsdated.conf except -U, which can (and should) be compiled out.

On Linux you can set "should-sync-hwclock" to no; the kernel will do that for
you nowadays. The other defaults look sane.

Unfortunately, the Gentoo ebuild for this uses openssl. At least it has seccomp.