It seems natural to say "who'd've" in speech, but is this incorrect?

Written English is different from spoken English. If "who'd've" is part of a direct quote or you're trying to reproduce colloquial speech, it fine.

However, in almost all other cases, the reader will stumble around with all those apostrophes. Our brains don't read words the same way we hear them. Your three options of "who would have," "who'd have," and "who would've" are all good options for print. "Who would have" is more formal and good for texts that do not use contractions. If contractions are used in the text, then "who'd have" and "who would've" can be used interchangeably without issue.

SpringKS pretty much covers it in her answer, yet I would like to build on her answer with a few numbers to help get a very rough idea of the relative popularity of some of the proposed ways of spelling who would have.

First off you should take a look at Google's Ngram Viewer, which gathers it's data from books. This graph shows who would have as the clear winner. This is completely expected as books tend to be quite formal.

The internet tends to be a little less formal, so by searching for some of these phrases with quotes we get the following number of results returned:

• Who would have - 134,000,000 results
• Who would've - 9,340,000 results
• Who'd have - 6,210,000 results
• Who'da - 511,000 results
• Who'd've - 68,800 results
• Who'd 'ave - 11,000 results
• Whowoulda - 3,840 results

Even in a slightly more informal setting you can still see the majority of people taking the precious extra few seconds to type out the entire thing. Who would've and who'd have seem to be reasonably close. Who'da also seems to be more common than who'd've. As mentioned earlier however there is nothing wrong with any of these options in the right context. They will all get the meaning across.