Protecting privacy by splitting trust