In the past, I've used YUMI (Your USB Multiboot Installer) by Pendrive Linux but almost immediately switched to Ventoy when the project started because of the convenience and flexibility it provides.
It's concerning, especially the part with the fake certificate. And despite two different issues and two different projects (Ventoy and iVentory) mentioned in the link you provided, the dev-trust seems to be broken.
This reminds me of a similar certificate case with RustDesk.