You really can't protect against a malicious sysadmin. Let them be bitten, maybe they will be smarter next time.