Revisiting Benchmarks for Privacy-Preserving Image Classification