I wonder what APIs of bitcoind I can use to sign a transaction without actually publishing it. I read that createrawtransaction (in conjunction with signrawtransaction) is a bit risky and for sure poorly documented. Are there any alternatives?
Using bitcoind, sendrawtransaction is one of the steps normally performed. So to not broadcast, simply omit that command.
For an alternative, you might want to look at SX>
SX is a set of modular Bitcoin commandline utilities that admin types can engage with Bitcoin functionality without having to write code.
Using the Mycelium mobile app has to be the easiest method to spend funds from a paper wallet. From the app, select Cold Storage. Then scan the private key from the wallet. Then scan the QR code for the Bitcoin address to send the funds to.