If ultrashort expiry time really mattered to you and ntpd not reliably working, you could always make a request of S3 and use the response's version of the date (which presumably is the version of time that really matters, as far as S3 is concerned).