To Town. To all fellow players. In scum's case they have no reason to doubt you.

Here is the thing: the point of the Mayor's compulsive vote is that he has to make use of it: either vote for a Townie or a fellow scum for the WIFOM. And Town has to guess: "Well, if the mayor is voting for X, then X is Town. But maybe that's what he wants us to believe. Is it just distancing?" There is a huge WIFOM potential.

If the Mayor chooses randomly, that whole aspect is gone. But Town can't know that Mayor is telling the truth. "He says he chose X randomly. But he could easily be lying. Is X an imporant Townie? Is he bussing".

But if the Mayor can actually prove that he chose randomly, then the whole aspect of compulsive voting is gone. The Mayor's vote is random, so there is absolutely no reason to look for any meaning in the vote. All the WIFO is gone. This is why the Mayor shouldn't be given the ability to prove he used random.

The paid random.org account allow you to carry a random draw by admins of random.org. In most giveaways here, we only have the organisers word for it that he/she used random.org, but since these are just small giveaways for games, it doesn't matter.
But consider huge raffles with big rewards, or raffles for which people had to pay to enter. The organiser can use random.org to select the winner but there is no guarantee he was truthful. Participants can easily say "yeah that was fixed. It was obviosly set up so the organiser's friend wins the car. What a waste of 10$".
By getting the random.org paid account you can have raffles carried out by random.org staff, so you can guarantee that the raffle wasn't fixed by you.

As for encryption, an example would be something like this: On D1, the Mayor can write "For my D2 choice, I'm going to take the next mod post, convert all characters to binary, sum up the total, add the post number, divide by the number of participants and the remainder (mathematical mod) will be used to determine whom I vote."
He then encrypts it, posts the encrypted message. No one can read it yet, since it's encrypted. On D2 he uses the method to determine whom he votes. He then posts the key and decrypts the message. Everyone can read it now. Since the method is seeded by (depended on) a Mod post which the Mayor at the time of writing couldn't have known (even if he could guess the next Mod post being a "vote count", he couldn't know the exact composition nor the post number) then unless the Mod is in cahoots with the Mayor, everyone can be sure that the vote selection was done pseudo-randomly.