Openbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.

If it's assuming that it can make an internet connection, why does it do that rather than NTP?

It is a sanity check to protect against malicious ntp actors.

http://man.openbsd.org/ntpd.conf#CONSTRAINTS

NTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.

You can always use a gpsd(4) compatible USB dongle as the time source.

Sure, if you have such a dongle, and it has sufficient view of the sky. Adding a 'free' https based sanity check on top of NTP seems like a good balance of cost vs reward.

gps (and friends) is a nice way to get access to a very accurate timesource, but it's not always worth the cost.

Or run their own NTP server. That's what I do in my home network.

GPS doesn't send full time. It wraps every 1024 weeks, or about 20 years, hence you need a (very) rough basis in case the system is over 20 years old.

It's easy to turn off the feature, and its described in their original blog post. The article doesn't mention it directly though.

The fix is to disable.

Here's the PowerShell cmd to do so: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "UtilizeSslTimeData" -Type DWord -Value 0