Is a nonce considered 'secret' enough for HMAC?
No, the nonce is not fit to be a HMAC key, because anybody can view the nonce in transit. If - on the other hand - the TLS connection does deliver enough security then you would not need the HMAC.

It's fine to use the nonce as one time code, but you don't need the HMAC for that. If an attacker can obtain nonce's send to clients than the attacker can always replace the original nonce with another one by redoing the HMAC calculations.

Note that your solution space may be empty if you cannot trust the client application. That sounds a lot like trying to implement a DRM scheme.