Does anyone know of a way to trigger a small script to execute after the clock syncs with an NTP client? The script relies on an SSL certificate that isn't valid until the clock is right. So far, the only thing I can come up with is to schedule a script every few seconds to check it which is hacky.

Normally only a loss of power can cause a loss of time.

Turn off your device [not reboot], turn it back on and check how many seconds it takes for the NTP to sync,
then add (for example if it takes 30 seconds, add 10 seconds for tolerance)
:delay 40s
at the beginning of the script.

This isn't for a reboot scenario, but part of a TR069 provisioning process.