anchor.diff:          default = config.networking.timeServers;
           description = ''
             The set of NTP servers from which to synchronise.
  +        '';
  +      };
  +
  +      enableNTS = mkOption {
  +        type = types.bool;
  +        default = false;
  +        description = ''
  +          Whether to enable Network Time Security authentication.
  +          Make sure it is supported by your selected NTP server(s).
           '';
         };
   
  
positive.code: 
      driftfile ${driftFile}
      keyfile ${keyFile}
  
      ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
  
  
negative.code:   keyFile = "${stateDir}/chrony.keys";
  
    configFile = pkgs.writeText "chrony.conf" ''
      ${concatMapStringsSep "\n" (server: "server " + server + " iburst" + optionalString (cfg.enableNTS) " nts") cfg.servers}
  
      ${optionalString
        (cfg.initstepslew.enabled && (cfg.servers != []))
  