That may work in theory, but it's not always possible to know who's on your side. For an especially control-obsessed agency like the NSA that wants to know ever

That may work in theory, but it's not always possible to know who's on your side. For an especially control-obsessed agency like the NSA that wants to know everything, this approach is completely unpalatable. Large institutions with sensitive information, whether public or private, generally don't know or trust their lower level employees (and a sysadmin is "lower level" in this context). They want solutions that prevent access by default. The NSA seems to have figured out that relying on sysadmins as a trusted party (a contracted trusted party, specifically) exposed a big hole in their ability to control things. It should have been obvious that contracting out a role that requires an extreme amount of trust was a bad idea, but large institutions often don't learn obvious lessons until someone makes them pay for their mistake.