Yes, the transfer agent can ask for a key signing before moving funds, but they also need to be able to transfer WITHOUT the key. Examples would be a key loss or transfer of ownership due to court order. I don't know what the key is doing since it's optional and highly fallible proof of transfer intent.

At best the key signing is providing a partial audit trail with no case law to support any liability transfer created by its use. Typically transfer agents take very little liability by requiring a medallion signature before allowing a transfer.

In a custom blockchain it can be configured to have admin method to transfer without a signature. But the question is why.. Why assets cannot be bearer?

Bearer instruments are linked to money laundering and we largely outlawed in the US in the 80s in relationship to securities.