Every box is checkable

1. Before the first pull we publish a hash of the card list and a secret. After that we cannot change the cards.
2. The order is shuffled with a public random number from drand that did not exist yet when the box was sealed, so nobody could pick it.
3. Pull number k always gets the card at ticket k. Nobody sees which cards are gone until the box closes.
4. When the box closes we reveal the secret and the full order. Your browser re-checks all of it.