Privacy-Preserving Formal Methods