Clients seem to like to do this a lot. Most people probably just allow it forever and forget because that's the intended user behavior. Signing timestamps for notifications in Primal, the old Iris, and I seem to recall some odd ones popping up in Snort, but I'm going from memory.