I'm looking into this right now. I think what we want to do is to ship with systemd-timesyncd.service enabled by default