Why is it important that the secret is at the end when signing with MD5?
See "extension attacks" in the Merkle-Damgard construction. This issue arises in the use of hash functions for message authentication.

In short, putting the secret in the beginning allows the attacker, given a message and its hash, to forge any message which has the given message as a prefix. This is a problem for naive codes but is avoided by well-known codes like HMAC.