Why would the replay attack necessarily be immediately apparent if you start out synchronously and only very slowly build up a delay, especially if combined (as you suggest) with a momentary gap and re-acquisition to mask any unavoidable slight initial delay?
It does not work mathematically. If you delay signals from one satellite, then you need to simulate signals arriving _faster_ from another satellite (on the opposite side of the sky), assuming the receiver is not diving down into the Earth. And you can't do that because you can't predict the timestream.
The receiver should be able to detect this inconsistency and try to filter out the faulty signals.
To make this attack feasible, you need to "prime" the receiver by delaying ALL the signals, but that is only possible if you control the initial timestamp sync.
Hence first slowing down everything for a while so the attacker has some headroom for the signals they would need to speed up.
Alternatively, just slowing down some signals more than others would still amount to a global slowdown, with some signals being sped up and others slowed down relative to the sum. If all signals drift into the same direction simultaneously, a receiver would just interpret this as its own non-precision oscillator running slightly fast and adapting, right?
Even if feasible, this would still be a much weaker threat than that of a completely attacker-chosen location, velocity, and time, but it could still be catastrophic (imagine e.g. introducing a gradual shift to an aircraft's navigation system and nudging it across an international border that way).
I looked at the spec, and the receiver should be able to detect that. The holdover time should be at least 30 minutes, long enough to witness multiple signatures come in. The timing between them is fixed, so the receiver should be able to detect the attacker slightly delaying the signals.
But I certainly believe that the actual receivers might not be hardened enough for that.
