dnssec and (vs) ntp
Specify at least one time-server by IP
Otherwise if system time is too different from real time, dnssec will prevent ntp from resolving names as all certificates are outdated.
Thus NTP cannot set the time and the problem will not be resolved automatically.