Certifying Out-of-Domain Generalization for Blackbox Functions