I was trying to say, Stunnel would probably work, but SSL isn't bullet proof.
There are many tools and techniques available to monitor a network you control.
Saying "Use Stunnel and you'll be fine," may not be exactly true. If he's discovered using Stunnel and gets canned, what do we say...