> and that should be easy for a receiver with a few bits of local storage unless unless it gets a single spoofed or corrupted signal, then it's stuck in the fu

> and that should be easy for a receiver with a few bits of local storage unless unless it gets a single spoofed or corrupted signal, then it's stuck in the future. Of course you can implement countermeasures, like requiring months of observation to advance the flag, but that makes it much less easy (and harder to test). > it's been powered off for more than a decade. That's also a concern. You don't want a receiver to get hit by lightning then get swapped out with a spare on the shelf and suddenly get the wrong date. Now you need a provisioning step that requires remote access to a normally completely embedded component. Again, not insurmountable-- but it's getting away from easy.