privacy-enhanced revocation