Verifiable, Distributed Secret Santa Assignments
Reform the problem. Instead of each participant picking their givee (which they give to), have them select a giver (which they receive from).


Each participant randomly generates a number (appropriately large) and anonymously submits it (e.g., via the tor network) to the site. This number represents them as giver.
After all participants have entered, the site publishes the list and participants (1 at a time, in no particular order) select (and remove) a random number from the list, linking it with their public name as a recipient to the giver-id.
After all participants have selected a giver-id for themselves, the validity criteria is evaluated: Each participant observes the specific co-participants with whom they conflict (i.e. immediate family members). If a conflicting co-participant possesses the observer's giver-id, that observer anonymously (via same channel as in step 1) registers a conflict.


If no conflicts occur, each participant now knows to whom a gift should be given: the co-participant possessing their giver-id.
If one or more conflicts occur, start over at step 2 with the restriction that participants cannot chose the same giver-id as before.
If all combinations are exhausted, start over at step 1 by re-choosing giver-ids.



The probability of success and/or expected iteration count is left as an exercise for the reader.