I’m now caching profile photos for webmentions I receive in the ProcessWire Webmention plugin. I borrowed Aaron’s method from https://github.com/aaronpk/ca3db/: hash the image file and use that as the filename; if the filename already exists, use that, otherwise store the new image. One step closer to https-only!