How to securly move bitcoins from a wallet.dat file to a paper wallet?
You have correctly answered your own question in the list following "The secure way should probably be something like [...]". You could skip step one by using the command-line API to the bitcoind client you presumably already have installed and used to generate the wallet.dat in the first place, but this is very tedious as you may have to manually list all the inputs to include in the transaction in a createrawtransaction API call, and then echo the output back into a signrawtransaction API call, before getting the signed transaction for step 3. If you want to investigate this route, check the API Calls List.