I had a few thoughts:
1) Maybe we're just misusing the API: it seems like there should be a way to get a timeout on each individual read() call which is distinct from timing the whole transfer. Need to just look into this more carefully.
If that fails:
2) change the config to be "per megabyte" - eg if you expect to transfer 5MB/sec, then you can set the timeout to 200ms/MB. Alternatively we could set a "minimum rate" - eg in this case you'd set to 5MB/sec, and if we are downloading a 50MB image, it would set timeout to 10sec (+ some fixed extra time)