If I were to capture a TLS session (and shared secrets) between myself and a web site operated by another party, could I later use the HMAC (or something else?) to verify to a third-party the authenticity of the downloaded data, i.e. prove that I did not alter it?
Note that your description is missing an important party: that to whom you wish to prove you did not alter the message. The question really is, can that party trust you not to produce a message you didn't exchange with the other party in the TLS session.
The answer is no, because you have saved the key, and thus you can generate valid tags for any messages as you like, which you might not have sent to the other end of the TLS connection.