Their "problem" is easily solvable by pairing sysadmins up. Make sure every command or windows click is seen an authorized by another, maybe even an anonymous sysadmin at a different location. If one sysadmin "steals" secrets, the other sysadmin would be implicated, so they have a lot of reason to pay attention. Costs will increase, of course.