Separation of Duties - Can a DBA patch or Upgrade a SQL Server 2008 R2 DB without TDE Encryption keys?
TDE only encrypts the data at rest.  If they have the access to connect to the server and query the database then they can get to the data.  

But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server.

The only way to separate the job functions as you seem to want would be to use the application to encrypt the data, that way it's actually encrypted in the database.  Then even if someone has select rights to the database they can't read the data without the key.  But that adds a lot of overhead and makes a lot of things harder.