Neat! i can see how this works for a two-player coin flip, but i'm not sure how one might generalize it for n players.

Notice how in Lloyd's coin-flip lottery, one of the Pick transactions would need to be chosen arbitrarily by Alice. Bob might be able to claim the output of the Pick TX depending on his choice of bit, and depending which Pick transaction Alice chose.

The problem with protocols that involve more than 2 agents is that everyone has to assume everyone else is colluding with each other. If you add a third player (Carol) who also receives an oblivious signature from Alice, then how can Bob be sure that Carol isn't colluding with Alice? If the two collude, then Carol can simply tell Alice which Pick transaction to publish so that Carol wins the 3-way lottery, thus taking Bob's money.

For an n-player lottery to work fairly, it has to be impossible for anybody to predict or dictate the outcome in advance, as long as at least one player is honest.

It's all detailed here. Specifically:

This lottery protocol is not entirely trustless, as the market maker has the sole ability to determine which of the players receives the jackpot money. However, all the complexity described above is designed to assure players that, in the event of cheating by the market maker, they can construct an irrefutable proof that the market maker cheated. The market maker can similarly prove irrefutably that a lottery was executed honestly and fairly.

The market maker can also cheat by going offline (not awarding the jackpot at all), but I also describe how they can commit to revealing at least one winner

To prove his intent to cooperate, the market maker can commit extra collateral to the lottery, forcing himself to reveal one of the outcome secrets shortly after the settlement height h, or else forfeiting his collateral. The satoshi value of this collateral can vary, but to be a worthwhile incentive, it should be enough to put the market maker at a meaningful net loss if surrendered.