There are two known ways to achieve this: - Multi-party computation. Too much overhead for something like this. - Remote attestation, as seen in e.g. Intel SG

There are two known ways to achieve this: - Multi-party computation. Too much overhead for something like this. - Remote attestation, as seen in e.g. Intel SGX. Usually provided by the CPU vendor. Not a cryptographic guarantee, more of a "it'd be very hard to defeat this if you're not Intel". Probably not that warrant-resistant.