General rule of thumb: a misbehaving/slow server in any well-architected distributed system is vastly worse than a dead server.

technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

> technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

Either go with one clock in your NTPd/Chrony configuration, or ≥4.

Yes, if you have 3 they can triangulate, but if one goes offline now you have 2 with no tie-breaker. If you have (at least) 4 servers, then one can go away and triangulation / sanity-checking can still occur with the 3 remaining.

Your probably meant trilaterate.

Sure, but not needing a failure to cascade to yet another failsafe is still a good idea. After all, all software has bugs, and all networks have configuration errors.