Three architectures promise institutional privacy onchain. Which guarantees are cryptographic controls, and which are promises someone can break?