Thanks for the PR! Currently, by leaving the audience null, it will skip checking the audience when a task is processed. This is for apps that don't need this level of security because they have their task handler not publicly accessible like here. I think this PR would break that set up.
May I ask what the problem is? That way I understand it better and can help think of some solutions.