Secure statistical analysis of distributed databases, emphasizing what we don’t know