This checker reads the rules, it does not define them. It never issues a token. Results are advisory until the AAI profile is ratified.
Without these, the expired and wrong-audience checks are derived from the token above. A derived token cannot be re-signed, so a rejection is inconclusive. A token obtained from the issuer is properly signed, so the result becomes definitive. On an opaque token these two fields are the only way to test those claims at all.
Ready.