A chrony source remains reachable through an ACL exception, but NTS validation breaks after the host trust store drops the old root

Time sync traffic still flows, yet secure validation now fails for one trust-specific reason.