RX_RECORD_TOO_LONG. This happens regardless of whether I try to download the image using Firefox or cURL and regardless of what internet connection I use. My instance is able to proxy them though, strangely.
I suppose I could try writing my own little download utility using a different SSL library, but I don't wanna do that right now.