Unfortunately, I think this is the important one, because it's not replaceable. If you foresee a problem with serializing, you can use a different serializer, but Element.copy and Element(anElement) are critical parts of the API. And if you are running a server that is meant to handle arbitrary incoming documents (and assuming you have some check for gross size), then blowing up on nesting depth is really not acceptable.

A way to avoid the API wart would be to check if the element to be copied is an actual Element or a subclass, and in the latter case, using sourceElement.getClass().newInstance() to call the argless constructor.