Privacy-Preserving Contrastive Explanations with Local Foil Trees