> So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

I honestly don't understand how you've made this an adversarial situation. It's almost as if you take offense to Smartscreen telling you it doesn't trust your binary.

The system is pretty straight forward, Smartscreen checks the file source against a list of known bad actors. If there's a hit it's saying "I can't vouch for this".

I checked and WinMerge isn't flagged in Smartscreen. The publisher however does not use a signing certificate which results in a UAC prompt.

In any case neither of these features prevent installation, they're just warnings you can circumvent.