I like your answer because you're describing a new threat model: an adversary tries to subvert the encryption process. Their service does not protect against such a threat.
Securing the data center is the least of your worries for such an attacker. I'd detail additional attacks that all subvert the encryption process:
1. Compromise the site's private SSL certificate. This allows the possibility of MITM attacks. There is some evidence that NSA is already mounting such attacks on the Internet.
2. Malware on the client-side. A compromised browser, or a compromised OS.
3. The US government mandating that NSA installs hidden firmware on all data center servers.
I argue that strong semantics are extremely important when building secure services. I thought their service offers one such semantic: client-side form data encryption. They do not offer JS code integrity or any guarantees about the client-side encryption not being subverted.
By telling people about datacenter security and then calling it a "a detail that some people who are security-conscious might care about" or "data center security probably does matter", you continue to raise the fog of confusion in people's minds. Instead, the FAQ could educate the users and separate client-side encryption (which is what the service offers) from client-side code integrity (which the service does not offer).