You need to use an offline computer, preferably a permanently airgapped one with a clean OS, import your private key there and sign a transaction on this airgapped computer, and then move the transaction to an online computer to be broadcast. There's a good post from LoyceV about this here, which I'll just link to rather than re-hashing all the information -
https://bitcointalk.org/index.php?topic=5318475.msg56389821#msg56389821. Make sure to verify your Linux and Electrum downloads before installing/using them.
I noticed one things about this method. The user can be able to make a transaction using the watch-only wallet and use the airgapped device to sign the transaction. The transaction can be any amount of bitcoin of choice owned, and yet the private key remains offline before and after the whole process.
Your are bang on correct. It's a very old paper wallet and I am not able to import it into any new hardware wallet. But I want to learn the most secure way to move said paper wallet into a Ledger.
Follow o_e_l_e_o post above.
<...>
But, in case the user is done using the paper wallet, can my method above be used if bitaddress.org is run offline? Normally, the private key will still be exposed online on electrum, but the user will sending the total bitcoin to an address on his hardware wallet?