So, lynis informs me that I should unset
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or they could use it to figure out my update schedule and try to attack in the brief interval during which the machine's restarting but before the firewall comes online, or something else I haven't thought of.
I understand it's not ideal.
The timestamps are used for two distinct mechanisms: RTTM (Round Trip Time Measurement) and PAWS (Protect Against Wrapped Sequences)
Those also seem like nice, useful things to have. That having been said, IIRC from my networking classes that RTTM method definitely isn't necessary for determining RTT, and TCP's sliding window makes sequence wraparound issues unlikely, but since this isn't one of the joke RFCs I'm assuming they had a good reason for proposing these things and implementors had a good reason for implementing them.
Are there any (likely) disadvantages / negative usability or security implications to disabling this feature?
Additionally, is there any way I can both have and eat my cake (by, for example, telling the kernel to initialize with a random value and introduce jitter into the period of the timestamp updates, or initializing it with some of the bits of the system clock, so they can't use a sudden, large change in timestamp to tell a reboot recently occurred)?