The entire premise of "other countries can trust your companies to protect their privacy" is that you can't. "US reads Dutch emails" is the thing you have to not do.

You can be strict about who you do business with while still respecting their privacy once they are set up.

The respectable, politically popular country setting this up would simply say yes to the International Criminal Court, but no to Putin.

This doesn't work well as a blacklist of "everyone's allowed unless they turn out to be sanctioned", because some shell company or reseller could register and actually be a front for Russia or whatever other bogeyman. But just serving enormous respectable organisations is a big niche in itself.