Digital signatures using a partially public key I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. 

To formalise it a bit, the signature is essentially $$MD5(msg, concat(pub, priv))$$ 

Since the entire key isn't (completely) known to the public, are such signatures considered secure? Should the merged key be hashed and/or derived from a KDF before applying it to MD5 (or HMAC for that matter)? 

Perhaps, something like $MD5(msg, concat(KDF(pub, n), priv))$ where $n$, the number of rounds, is randomly derived from the public key? The rationale is that even if the attacker knows the public key, they won't be able to derive n, which protects the private key from some kind of text attack.
A few things.  First of all, MD5 is broken, and no longer suitable for cryptographic purposes.  Instead, prefer newer algorithms, like those from the SHA-2 family (SHA-256, SHA-512, etc).

Second, the term "signature" in cryptography is defined more narrowly than you would expect.  It specifically refers to situations where there is a public key (the "verification" key), and a private key (the "signing" key).  Everyone can verify a signature themselves, if they have the public key.

It sounds like what you're actually after is a Message Authentication Code (MAC).  MACs use a single "secret key" for both signing and verifying, instead of having separate keys for each purpose.

Since that's the behaviour you want (assuming I understood your comments correctly), it's best to use an algorithm designed for that purpose, such as HMAC-SHA256.