The linked blog post implies that they don't even have any of their own stratum 1 servers, they've just negotiated to get authenticated time from some other peo

The linked blog post implies that they don't even have any of their own stratum 1 servers, they've just negotiated to get authenticated time from some other people's existing stratum 1 servers via the existing NTP symmetric crypto protocol. Edit: dropped their address in my NTP config, and the Cloudflare server I got is a stratum 3. Don't see many of those about now, generally pool.ntp.org returns a mix of stratum 1 and 2 servers at least for the UK. Guess it's not too surprising if they're getting time from a handful of third-party stratum 1 servers and then distributing it to their edge nodes though.