Here is another idea:  Instead of storing the email address directly, we can
store an SHA1 hash of the email address.  Meanwhile maintain a mapping from
hash back to email address in an auxiliary database table.  This auxiliary
table can be used to translate the hash back into an email address for display
to authorized users.  But because the auxiliary table is not shared as part
of a clone or sync, remote repositories are unable to recover the original
email address.

There would need to be some way to share the auxiliary table with authorized
users.  No such mechanism currently exists and needs to be added.  But on the
other hand, such a mechanism might also be used to share ticket report formats,
which is something else that is currently not shared but which ought to be.