Indeed. There's a tradeoff in both directions - either you trust the cloud^W grid, or you trust your local clock, and both of them have failure modes; there's no one clearly superior option here. You could combine them, but then it gets complex in short order.