Differential privacy in the shuffle model