1) The data is encrypted in a way that Mozilla can't encrypt it without the help of ISRG.
2) There is a way for ISRG to help Mozilla create aggregated data from the raw data without either of them being able to see the raw data in this process.
Maybe I'm wrong. Would be interesting to hear how 2 can be accomplished. Would have to be some crypto magic I have not yet heard about.
So Mozilla becomes the treasure-guard? What prevents them from abusing or leaking the data in the future?