Secure, privacy-preserving analysis of distributed databases