Audience claim validation in key proofs

According to Section 3.4 the Credential Issuer must verify the proof(s) of possession contained in a Credential Request upon receiving it. Appendix F.4 specifies how a key proof is validated by a Credential Issuer. However, this list does not explicitly mention the audience claim validation. Furthermore, it is not explicitly stated which values of the audience claim are considered as valid. Given the specification of the jwt proof type in Appendix F.1, I believe that it would be reasonable to only allow the Credential Issuer Identifier as a value of the audience claim.

I am seeking clarification on why the validation of the audience claim is not explicitly specified, and which values are considered valid for the audience claim. This clarification would help ensure consistent and secure implementations across Credential Issuers.

Start by comparing Section 3.4 with Appendix F.1 and F.4 of the linked OpenID4VCI specification, focusing on audience claim validation for key proofs. Determine which audience values the specification should explicitly permit and document the clarification; done means the validation rule and accepted values are unambiguous to implementers.