I have a few questions concerning the 'asset-freezing protocol' that I hope you will be able to help me with.
1- It is my understanding that only the entity that created the tokens can freeze them, ...
From the 'Accounts' section of the docs:
Currently there are three flags, used by issuers of assets.
Authorization required (0x1):
Requires the issuing account to give other accounts permission ...