A system for synchronizing a clock includes a phase-locked loop (PLL) circuit that generates or receives (304) timing errors that are based on timing information from multiple timing sources. Gain blocks (214) weight (306) the timing errors, which are then combined (308) into a loop time error. A loop integrator (226) integrates (310) the loop time error to produce an input used to adjust (312) an oscillator frequency. A corresponding oscillator clock signal is fed back (240) to one or more phase detectors (206), which receive (302) timing reference signals and generate timing errors. When a timing errors indicates that a problem exists with a timing source, the impact of the problematic timing source is reduced (430, 504), or oscillator frequency adjustments are suspended (608). When used on a satellite (700), at least one of the timing errors can be based on times of transmit and times of arrival of time messages exchanged between the satellite and its neighbors (716).