The ISP should be closest server to sync to and Cloudflare is anycast with
potentially lower stratum than the other nts servers. 'nts' implies 'require'
and 'trust' already and other servers get picked over lower stratum although
higher distance.
They appear to be the only bigger party hosting NTS in addition to
Cloudflare and being in neighbouring country isn't too bad
Via https://gist.github.com/jauderho/2ad0d441760fc5ed69d8d4e2d6b35f8d
which encouraged me to look into them a bit more. Additionally having
read chrony or chrony.conf manual on default behaviour implying NTS
servers are "require trust" and when mixing them with NTP servers, NTP
servers never get selected unless they agree with NTS servers.
I hope these are wider defaults than just Debian and allow me to not
conflit with package manager, but regardless having a separate
sources.d/ looks like a good idea for being able to `chronyc reload sources`