An apparatus for secure time management, comprising: - a non-volatile storage to store a synchronization time and a first maximum drift rate associated with a first counter; - the first counter configured to increment at a first predetermined frequency; and - a processor configured to: - generate a request for a current time, the request to include a nonce generated at the apparatus; - transmit the request to a trusted timekeeper; - receive a response containing a current, real-world time from the trusted timekeeper, the response being digitally signed with a digital signature; - verify the digital signature of the response; - verify that the response is received within a predefined time; - compare the nonce in the request to a nonce in the response; - determine that the current, real-world time received from the trusted timekeeper is within a range of a first current time calculated at the apparatus based on the synchronization time, a number counted by the first counter, and the first maximum drift rate; and - update the synchronization time with the current, real-world time in the response received from the trusted timekeeper when the current, real-world time is within the range of the first current time. - a non-volatile storage to store a synchronization time and a first maximum drift rate associated with a first counter; - the first counter configured to increment at a first predetermined frequency; and - a processor configured to: - generate a request for a current time, the request to include a nonce generated at the apparatus; - transmit the request to a trusted timekeeper; - receive a response containing a current, real-world time from the trusted timekeeper, the response being digitally signed with a digital signature; - verify the digital signature of the response; - verify that the response is received within a predefined time; - compare the nonce in the request to a nonce in the response; - determine that the current, real-world time received from the trusted timekeeper is within a range of a first current time calculated at the apparatus based on the synchronization time, a number counted by the first counter, and the first maximum drift rate; and - update the synchronization time with the current, real-world time in the response received from the trusted timekeeper when the current, real-world time is within the range of the first current time. - generate a request for a current time, the request to include a nonce generated at the apparatus; - transmit the request to a trusted timekeeper; - receive a response containing a current, real-world time from the trusted timekeeper, the response being digitally signed with a digital signature; - verify the digital signature of the response; - verify that the response is received within a predefined time; - compare the nonce in the request to a nonce in the response; - determine that the current, real-world time received from the trusted timekeeper is within a range of a first current time calculated at the apparatus based on the synchronization time, a number counted by the first counter, and the first maximum drift rate; and - update the synchronization time with the current, real-world time in the response received from the trusted timekeeper when the current, real-world time is within the range of the first current time.