1. AWS Lambda is "verifiable infrastructure". You can fetch the code and verify that it's the same code as what you've provided elsewhere (as a reproducible build for eg)
2. Use the lambda for trusted-code-execution (say collecting hashes of your contact list, matching them against a bloom filter). The code isn't supposed to log these contacts, or save them in any way.
3. You create a AWS IAM keypair that has permissions to get each revision of the lambda code, validate the corresponding API endpoint.
4. Instead of using a custom-domain API Gateway, you instead use the AWS execute lambda endpoint. The request directly reaches the lambda - verifiably (I think).
5. Publish the keys for the AWS IAM keypair that was created above.
Anyone in the world can then call up the Lambda management API to validate the code at any time with these credentials. If you trust AWS Lambda and IAM, there is a verifiable trust in the code that is running on that lambda and that is processing your contacts.
This might be possible by setting up an IAM Assume Role against the * to allow any AWS user the same permissions, but I'm not sure if that's allowed?
Edit: Documented on my ideas repo https://github.com/captn3m0/ideas#verifiable-code-execution-... , if someone is interested in building this