NTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.
gps (and friends) is a nice way to get access to a very accurate timesource, but it's not always worth the cost.