I think you need to perform one more "decoding" step before you pass it to $sce. For example like this:
app.filter('trusted', ['$sce', function($sce) {
var div = document.createElement('div');
return function(text) {
div.innerHTML = text;
return $sce.trustAsHtml(div.textContent);
};
}]);
Demo: http://plnkr.co/edit/LrT4tgYtTu4CPrOAidra?p=preview