Generating a segwit address and private key with bitcoinj (paper wallet)

Question

It is possible to generate a valid legacy bitcoin key pair with the following code which is using bitcoinj master branch:

import org.bitcoinj.core.Address;
import org.bitcoinj.core.DumpedPrivateKey;
import org.bitcoinj.core.ECKey;
import org.bitcoinj.core.NetworkParameters;

public class GeneratePrivateKeyBulk {

    public static void main(String[] args) {
        ECKey key = new ECKey();
        Address pubAddress = new Address(NetworkParameters.prodNet(), key.getPubKeyHash());
        DumpedPrivateKey privKey = key.getPrivateKeyEncoded(NetworkParameters.prodNet());
        System.out.println("Public address: " + pubAddress.toBase58() + "; Private key: " + privKey.toBase58());
    }
}

This creates a usable legacy base58 encoded public address and private key e.g. like 1ERzRYYdbibaQt2kuNfgH8spuoqQxYkwQb, L3AuZ2vNt11ac2xSi6AYwzXyftqSVPcSuHNdTsSuRfknXvoRtWzF correspondingly.

The question is how can I do the same operation to obtain a segwit key pair?

I looked at the bitcoinj docs but could not find any API for generating addresses directly as segwit.

By looking at the tests and the segwit pull request I found that the following code (appended to the code above) would produce a segwit address (i.e. one that starts with 3, e.g. 31uLnxKteEYa2u1vgWyVPkTpVfUGduCV82)

Script script = ScriptBuilder.createP2SHOutputScript(1, Collections.singletonList(key));
Address segwitAddress = Address.fromP2SHScript(NetworkParameters.prodNet(), script);
System.out.println("Segwit address: " + segwitAddress.toBase58());

My understanding is that the code above is supposed to be used in a multisig scenario, therefore I am not sure if this is the correct way to derive a segwit address from a single private key. Is this the correct/reliable/safe code for generating a paper segwit wallet?

Also, is there a way to add BIP38 password protection to the private key using bitcoinj? The class BIP38PrivateKey only has methods for decrypting a BIP38 key from an existing base58 representation, but no methods for BIP38 password encryption.