I think the idea is that the data is never decrypted until it returns to the client. i.e. it's encrypted client side while being indexable server side.

This means that your 'evil admin' case is invalidated since the plaintext data is never available to the host.