Where does the random number come in to play when signing a transaction? Just given all the news about this topic lately (Android security flaw), I'm curious about WHERE and WHY the random number is used during the signing of a transaction.

I always thought a transaction was signed by just hashing the prev_out** and then encrypting that hash with the private key, so when it is published along side the public key it can be verified by other nodes.

**(maybe I need more clarity here too: is the ENTIRE previous transaction  hashed at this point, or just one the input being used in the prev_out?)
This is a common misunderstanding. It just so happens that signing with RSA is the same as encrypting with the private key. But this is a quirk of the RSA algorithm. Bitcoin doesn't use RSA, it uses ECDSA. DSA is strictly a signature algorithm -- it has no encrypt operation at all.

The ECDSA signature operation, like the DSA signature algorithm, requires a random value in order to generate a signature. The signature consists of two derived parameters that can only be generated with the private key but that can be verified without it. The relationship between the derived parameters depends on the message, so the message cannot be altered.

Sadly, if the same random value is used for two signatures, the private key can be derived from the signature.