Pencil: Private and Extensible Collaborative Learning without the Non-Colluding Assumption