A radio receiver with a GPS time base doesnt seem that tricky.

If we assume the sender is not malicious, a properly configured NTP client ("the time settings of the sender") would probably suffice. If the sender is malicious, unless you somehow make the "signal + timestamp" from the receiver non-modifiable from the receiver to the service, you've lost anyway.

Because MLAT relies on multiple devices, it should be straightforward to identify and blacklist a sender tampering with timing data.