Anfonwch hwn fel neges destun: A separation-of-powers model for a trustworthy and open cloud computing ecosystem