Separation of Duties - Can a DBA patch or Upgrade a SQL Server 2008 R2 DB without TDE Encryption keys? Are there any considerations I should have in mind when I patch or upgrade a TDE encrypted database? In the context of separation of duties, does the person executing the patch or upgrade process need access to the Keys or certificates of a TDE encrypted database or can the database be patched without the keys. The answer is important because we are a legal shop and would like an application administrator to encrypt the database and outsource the db maintenance functions to a dba to patch and upgrade the database without having access to the “application data”. Could you throw some light on this please?
TDE only encrypts the data at rest.  If they have the access to connect to the server and query the database then they can get to the data.  

But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server.

The only way to separate the job functions as you seem to want would be to use the application to encrypt the data, that way it's actually encrypted in the database.  Then even if someone has select rights to the database they can't read the data without the key.  But that adds a lot of overhead and makes a lot of things harder.