A) So you have to put your private key into a website somewhere? That sounds risky
It's all javascript, you can download the page and run it on an offline computer.
B) How do I get the private key out of my wallet.dat file anyway?
No idea, I use web wallets.
C) Perhaps making a burner blockchain.info account would be a more secure method?
You use the private key of the account you paid with, so you can prove that it's you. Otherwise, I'd be able to request that your units be sent to me

EDIT: Not sure if I misunderstood. You certainly could transfer
BTC to a burner blockchain.info account, and pay from that account. The same warning still applies, that you need to have the private key of the address you're paying from.