NTP support is via a configuration option for NTPd.
restrict default mssntp
We didn't wish to reimplement this protocol if we could avoid it. The option to point to a different NTP signing deamon (a samba service, on by default) is:
ntpsigndsocket /var/run/ntp_signd/
The NTPd on the system must have been configured with --enable-ntp-signd