I cant remember how that works but I suspect the RTC is in the FIPS can and that it takes effort to set it. They wouldn't go to all that effort to put times in the KDM if someone could just bypass it by setting the system date. It's a pretty well thought out system.
Correct. The DCI says the secure clock only can be adjusted 6 min per year, 20-30 min with a code/package from the manufactorer. If it's adjusted over this limit the mediablock will have to be changed.