Privacy Preserving Recalibration under Domain Shift