Have a look at how Hive account@croupierbot used to work. Two step draw.

1. Announce future block to use for draw.
2. Use witness signature in deterministic draw.