They should just have the client send the server a full permutation. It's just an array of 52 numbers, quick to verify, quick to execute. It also has the full r

They should just have the client send the server a full permutation. It's just an array of 52 numbers, quick to verify, quick to execute. It also has the full range of 52! permutations, meaning no matter what permutation the server generates, the client can change it to any other permutation. That's the property you really want, in order to trust this.