It is indeed weird and confusing and I don't really understand what RPF has done there. There is a consistent pattern though.
If you look at the files inside the '2018-11-15-21:03' folder, you see timestamps close to the preceding timestamp folder.
So it could be I linked to the wrong folder, but that I was essentially still correct.
There was a /etc/fake-hwclock.data file with a timestamp (but no /etc/ntf.conf file ...)