It's entirely feasible to mitigate a lot of that insider risk. You have to pick the convenience/risk reduction trade off, though. For example, it may make sense

It's entirely feasible to mitigate a lot of that insider risk. You have to pick the convenience/risk reduction trade off, though. For example, it may make sense to disallow any unilateral access, and only allow signed, reviewed code to run. There doesn't have to be a single entity with universal root. In such an environment, encryption at rest can come in handy because it mitigates some of the physical attack vectors.