Ryoan: A Distributed Sandbox for Untrusted Computation on Secret Data