TLS session keys are derived as a result of authenticated key agreement.
Is being able to decrypt a record at an endpoint after receiving change_cipher_spec sufficient guarantee that the endpoint is accepting record from the authenticated peer? I believe 'yes'.
I understand that the verification of TLS finished message ensures that the handshake messages were not tampered by MITM. The decryption of TLS record containing finished message proves the record arrived from authenticated peer.
In the case of extended-master-secret extension, the master secret (and hence session keys too) are derived as a function hash of handshake message (i.e. transcript hash). Therefore, if extended master secret is used, being able to decrypt records after change_cipher_spec should prove both authenticity of peer & non-tampering of handshake messages.
In this case, can the handshake protocol do away with finished message without compromising on the security guarantees?