Ok, I misremembered it says “pay” for the aggregate results, not sell.
Our DAP deployment is jointly run by Mozilla and ISRG. Privacy is lost if the two organizations collude to reveal individual values. We safeguard against this in several ways: trust in both organizations, joint agreements, and operational practices.
A full solution will require that advertisers — or their delegated measurement provider — receive reports from browsers, select a service, submit a batch of reports, and pay for the aggregation results, choosing from a list of approved operators.
For the trial, the results for each task will be sent to Mozilla’s telemetry systems, which will be used to access aggregated statistics.
So it doesn’t say ISRG is going sell data, but the “full solution” will have other operators that get payed, i.e. they’re going to sell the aggregate data. Also, they envision multiple such operators, all of which it seems need to be “trusted”.