• There's a difference between security and privacy.
• There is no such thing as an image a user can't download.
• Unless the url says it's secure, it isn't.
• When it comes to privacy, you don't get something for nothing...or even next to nothing.
• Corollary: If you're really losing sleep over this and it's professionally important, you should be willing to pony up the cash.
• Know your threat model.

Somehow, I get the feeling that Jay over at thedigitalphotoraphyweblog is another photog-blogger with a background in security. What're the odds?

I think the second to last point is the biggest - if you want as much control as possible over your images, pay to host them yourself. Get your own server, or at least your own hosting account from a reputable host. Pay someone to build a system for you to display your images (if you can't do it yourself). Put all the safeguards in you can think of. You'll still get the occasional image used without permission, but you'll feel you've done everything you can to prevent it.

The only addition I'd make is to the second point - if you don't want it downloaded, don't put it on the net.