FLAME: Differentially Private Federated Learning in the Shuffle Model