The question isn't quite right: Trust isn't binary. I think you really want to know "How can I decide how much to trust a particular website?"
In the end I think it comes down to how much I must trust each particular site.
The sites that I have to trust the most (bank, brokerage, etc) I have a physical offline relationship with. The companies that run those websites have a significant offline reputation and presence; they correspond with me on dead trees via snail mail and they have a phone number where you can talk to a human. This is somewhat outside the scope of the question since you have said the only information you have is from the web itself, but even then you can verify the physical presence via multiple avenues. (Google, WHOIS, Wikipedia, online reviews -- e.g. bank comparison websites, etc.) Also, if I have to "fully" trust a site -- for financial info or other sensitive data -- then I am unlikely to do so unless I can have a reason to trust them that is backed up by a trustworthy significant offline presence.
The sites that I trust the least are those that I don't have to trust. JimBob's Game Zone & Happy Fun Time, for example: hmm, you say you've got this really fun game that I've got to enable java to play? Sorry, but no thanks. (The same is true even for somewhat more reputable sites that still have, say, java-based financial calculators that I'd like to use. I can find an alternative that doesn't expose me to a huge attack surface.)
In between there are sites that you have to trust somewhat, but not fully. In other words, you may need to expose yourself to some risk. For example, H&R Block has a calculator that estimates how much tax I owe for last year. I have to enable scripting and flash for their calculator to work, and I have to enter personal data (e.g. income, family status) -- and it has to be accurate (though not perfectly precise) in order for me to get the answer I want. I don't have to give any identification, so beyond the exposure to scripting and some limited data it's an acceptable risk; I may access via proxy to hide my data from my ISP and hide my location from the site.
Other sites want to collect tons of data from you, they want to identify you personally, etc, and they give you a service in return. Facebook or Google, for example; to a lesser extent, Stack Exchange. I, for one, choose to actively distrust the omnipresent sites: this takes effort since you have to block multiple domains via NoScript or other browser plugins to prevent the company from tracking you around the web. I choose not to use Facebook. I use multiple Google products, but here I've chosen to pay for their service with my data; I still block their tracking domains when I not using their products.
The issue at hand in the linked question is whether to trust an Ubuntu ISO image downloaded from a particular website. Based on what I've written above, I think the answer is that you don't have to trust it much, so you shouldn't. ("Trust, but verify.") Download the image from anywhere reputable enough that you don't waste your time and bandwidth. I'd probably pull the torrent: you don't have to trust any single site. Then verify the hash via multiple channels: check Canonical's website, check other websites, use multiple proxies to check those websites (so you are less likely to be MITM'd), ask on IRC, call a friend, etc.