I agree with your first and last, but I think the modal form can change in reported speech depending on the sequence or simultaneity of events.
The asking is happening now and so is the knocking:
He asks who it could be.
The asking happened in the past and the knocking happened at the same time as the asking:
He asked who it could be.
The asking happened in the past and the knocking is an event prior to the asking:
He asked who it could have been.
As an aside, I'll assert that when you say "Who is it?", you merely want the person's identity. "Who could it be?" implies extraordinary circumstances: ordinary people wouldn't be knocking. What sort of people knock at this hour? Emergency personnel? Pirates? (I'm exaggerating a subtlety to make my point.)