I finally figured it out by downloading the code and running the signing docker image on my local machine. Their support centre was barely helpful, so I'm leaving this for anyone who needs it in the future. In order to move funds out of the trading wallet, to a given public address, you can follow these steps:

Build TX

Call the build tx endpoint.

fetch(`${bitgoUrl}/api/v2/${coin}/wallet/${tradingWalletId}/tx/build`, {
  body: {
    recipients: [
          {
            address: destinationPublicAddress, // 0x...
            amount // (for 1 usdc, use 1000000)
          }
        ]
  },
  method: 'POST'
})

This will return an object with a payload string, among other properties

{
  "payload": "<json-object-stringified>"
}

Sign the payload object

This was the step that I was missing when I created this issue. I don't know how to get the key to sign with Bitgo's endpoint, but their UI is doing so. However, what I did, and you can do too if you're using the bitgo express docker image is to call a non-documented endpoint that does all the work for you. You can see the code of this endpoint here.

fetch(`${bitgoExpressUrl}/api/v2/ofc/signPayload', {
  body: {
    payload: JSON.parse(payload), // payload is the string object we got from the previous call
    walletId: tradingWalletId
  },
  method: 'POST'
})

This will return an object with the payload (again) and the signature

{
  "payload": "<json-object-stringified>",
  "signature": "payload-signature-in-hex" 
}

This endpoint IS NOT DOCUMENTED (so use it at your own risk), but it was the key for me to solve this problem without having to load and decrypt keys.

You also keep in mind that the Bitgo Express container must be run in production mode (as withdrawals from testing env are not enabled - See how to run in production mode here. In addition to that, keep in mind that even though the docs do not mention it, you must set BITGO_ENV=production rather than NODE_ENV=production) and the passphrase for the Trading wallet must be set as an env variable. See this on how to set the passphrase (you may need to use the Bitgo login account if it does not work.. awful, but it is what it is)

Send the payload and signature

This step was documented, but incorrectly . We need to call the tx/send endpoint, but following the example below 👇🏽 because the docs are incorrect as of 10/2023

fetch(`${bitgoUrl}/api/v2/ofcusdc/wallet/${tradingWalletId}/tx/send`, {
  body: {
    halfSigned: {
      payload: '<json-object-stringified>',
      signature: 'signature-from-previous-call'
    }
  },
  method: 'POST'
})

The docs INCORRECTLY tell you to send a txHex property, either as part of the body object or inside the halfSigned property. But that did not work for me.

This will create the transfer, and if required you will get an email invitation for a video call.

Important notes

Keep in mind you may also need to whitelist the destination address as a withdrawal address - you can do so from the UI

You also be aware that all requests above require the accessToken as a Bearer authorization header, with the proper spending limits set - omitted here for simplicity