His browser might still be manipulating it. You've only tried to prove his connection is secure, and did a poor job of it, btw. What does a random image on catbox prove if you relayed the link the a possibly compromised connection?