Against the Standard definition it seems InfoPath does evaluate CDATA
values.
I would expect:
<contentBlock key="testkey"><![CDATA[ <iframe
src="http://a-URL.foo/default.hml" name="testframe"></iframe>
]]</contentBlock>
in a text field to be shown as:
<iframe src="http://a-URL.foo/default.hml" name="testframe"></iframe>
Infopath shows a frame in the textbox and opens an IE showing the iframe content!