The answers to both of your questions are probably yes it’s okay, and yes you should probably be looking for another job.
Are you morally/ethically okay with your agency’s mission? With your role in it? If you are, then the new administration’s policies may not be reason enough to leave. You pretty much have to work somewhere. If the answer is no, you probably would have already been looking for another job.
Should you be looking for another job? Probably, depending on what your agency is and it’s mission. If TFG and Project2025 have their way, many federal government agencies will be defunded and/or privatized, and pretty much toothless when it comes to enforcement. We already saw what happened to the EPA under the first Trump administration. If yours is in danger of that you should be preparing a backup plan. I wouldn’t want to give up a government job, but I would want to be ready if I got RIF’d, or if I got fed up with the bullshit.

Don’t bug users to change passwords periodically. Only do it if there’s evidence of compromise.

About damn time. I log into my company laptop with a smart card and PIN or a PIN/authenticator code, computer autoconnects to the VPN, and I’m good to go. If there’s no internet available, the smart card will still get me into my computer. If I’m on my personal computer, I log in with the PIN/authenticator. This morning I tried really hard to find someplace where I had the option of entering a password and there is none, yet I have to change my password every 6 months. At least my IT department lets me use KeePass.