Provenance of Training without Training Data: Towards Privacy-Preserving DNN Model Ownership Verification