How are the SPConfig clockSkew attribute and a Conditions NotBefore related?

[Brian Reindel]

We're having issues where a third party identity provider on Windows
is setting the NotBefore correctly, but our CentOS box that has our
service provider is 30 seconds in the past. The session is expiring
immediately as a result. I thought the clockSkew would take care of
this discrepancy, and it is set to the default of 180. Am I
misunderstanding how clockSkew works?