Security firm Zealynx noted that blockchain rules requiring a private key to authorize transfers hold true only up to whoever controls the protocol's upgrade path