Are there any caveats with using random.org within this process? Is there any provably fair that does not involve the traditional client-server seed combo?
Yes. Someone can intercept the connection to Random.org and hijack the domain to point to a fake copy that outputs tainted random numbers.
Hence why you should never rely on an external service for generating probably fair hashes.
Quote
The Signed API has all the functions of the Basic API and also lets you prove that your random values really came from RANDOM.ORG (authenticity) and that your application has not changed them (integrity). This is useful for many applications, such as a finance, auditing, games and lotteries.
https://api.random.org/dashboardQuote
Secure HTTP
4096-bit EV-certificate ensures authenticity and privacy of your random data while in transit
Digital signing and sequence numbering
Allows strong non-repudiation, suitable for a wide range of applications, ranging from finance, compliance and accounting to games and gambling
Authentic true random data
Originating from RANDOM.ORG's proven true random number generators;
Operational since 1998 – we're here to stay
https://api.random.org/features 4096-bit EV-certificate ensures authenticity and privacy of your random data while in transit
Digital signing and sequence numbering
Allows strong non-repudiation, suitable for a wide range of applications, ranging from finance, compliance and accounting to games and gambling
Authentic true random data
Originating from RANDOM.ORG's proven true random number generators;
Operational since 1998 – we're here to stay
