How should false positives be reported when they occur?

[rickyboone]

We have a signature (TwinWave.EvilPDF.QakySoWaky.221221) that is likely hitting too many legitimate files to keep enabled in our use case. I'm aware of the process for debugging (for the most part) and adding signatures to an internally maintained false positive list, however for the developers/maintainers of the signatures, what process is preferred for reporting them?

I know this can be a bit of a can of worms, but I didn't want to assume how it should be handled upstream.