The opening call can happen over your api, that's fast enough for user experience, and already happening. You just need to publish the contents...you are a trusted authority right now, and if you disappear no new boosters should be opened anyway ;-)
The history entry of the opening contains a block number, I would've expected to find the contents of the pack published there (or in one of the following at least). But no custom_js transaction confirming ownership is so weird. The only way to take real ownership of a card is by buying it now.
That stands in clear contrast to the presentation on the website which says "every collectible card is a unique token that is owned by YOU". You or the licensed partners do not issue tokens (owned by us) for the cards before they're sold.