Current mechanism for BFT time includes a timestamp in every precommit, and just takes the median.

While simple and live despite arbitrary clock drift, it has some problems:

• can't be used for signature aggregation (since each vote has a unique timestamp component)
• gives +1/3 of the validator set complete control over the timestamp (see Interactions between BFT time & unbonding period #2653)

An alternative, originally proposed in #1615, is to let the proposer use their own local timestamp, and for validators to only vote for the block if the timestamp is within some range of their own clock. This requires all nodes to keep their clocks reasonably closely synced, and was originally rejected/postponed for this reason. But in order to solve the above two issues, we should reconsider this solution. We can also include an option to disable it, so folks that don't want to worry about synced clocks won't have to (but of course it means they might not have accurate timestamps in blocks).

We should write a new ADR for this and do some more analysis before fully moving forward with it.

Note there is also a follow up issue from the last BFT-time PR: #2309