`man clock_gettime' on this Linux box says:

AVAILABILITY
       On  POSIX  systems on which these functions are available,
       the symbol _POSIX_TIMERS is defined  in  <unistd.h>  to  a
       value greater than 0.  The symbols _POSIX_MONOTONIC_CLOCK,
       _POSIX_CPUTIME,   _POSIX_THREAD_CPUTIME   indicate    that
       CLOCK_MONOTONIC,                 CLOCK_PROCESS_CPUTIME_ID,
       CLOCK_THREAD_CPUTIME_ID   are   available.    (See    also
       sysconf(3).)

Availablility of CLOCK_MONOTONIC is system (and not just libc)
specific (for instance stock Linux 2.4 kernels do not have it,
2.6 do)

That will get a guaranteed-monotonic time regardless of settimeofday()
and friends.  In Linux it is the time since the last boot, but POSIX
doesn't guarantee that, just that it is monotonically increasing.  But
if what you want is a clock to use to trigger an event X seconds from
now, that's the one you want.

I don't know of a way to get the absolute time that will work across a
reboot or reset of the RTC.  That last seems like kind of a tall order
since it is the only thing in the system that keeps time when the power
is off.

NTP might do some of what you want, but if the goal is to have the time
be correct even if root tries to mess it up, then NTP won't help.