The ISP should be closest server to sync to and Cloudflare is anycast with
potentially lower stratum than the other nts servers. 'nts' implies 'require'
and 'trust' already and other servers get picked over lower stratum although
higher distance.
I hope these are wider defaults than just Debian and allow me to not
conflit with package manager, but regardless having a separate
sources.d/ looks like a good idea for being able to `chronyc reload sources`