[Ntp] Roughtime actually bounds the time

[Watson Ladd <[e-mail]>]

I finally have demonstrated the obvious: that roughtime bounds the
time difference between client and server, and this bound is easily
propagated forward in time given bounds on frequency stability (with
fairly simple formulas).  Driving a PLL crudely is also possible (one
gets a measurement, applies it, can go again: with sufficient
robustness in the loop this will work).

Many applications don't need to do this, e.g. certificate validation,
freshness of consensus etc. only need a crude check on accuracy.

I will hopefully determine text and upload a new version shortly. I
would appreciate input on what exactly people found lacking in prior
discussions of the security model.

Sincerely,
Watson