I completely agree with you. In my opinion, using GPS as Stratum 0 feels like a cheat. I do hope to some day (definitely not any time soon) own an atomic clock of some kind though.
Regarding PPS, the L76B does this cheaty thing where it actually sends the PPS signal over UART. They provide a calculation to go from “Time of first byte” to a regular PPS signal on the receiving side.
Regarding the Cloudflare part of this, I’d recommend taking a look at “Authenticated Origin Pulls”. It lets you perform your validation at the TLS layer instead of doing it with IP ACLs if that interests you.
You should probably be looking at the Cargo.toml file(s) (for direct dependencies at least) instead of the lock file as the lock file will include dependencies used for dev/testing.