The general problem (see below for the deposit-specific case) is indeed complex to deal with (both conceptually in a pure Merkle setting and practically due to the existence of zip bombs). I think a workable solution might be ingest the archive as is and also ingest a separate directory corresponding to the archive content, with some metadata linking the two. That way by default we will only return what we have ingested (without recursion), but we will offer ways to dig-in recursively, e.g., in the web app. There will be plenty of devils in plenty of details for this though.

For the deposit-specific case, I agree that we can consider an "error" any archive that is sent to us containing a single file which is itself an archive of some sort. We can easily add a check that makes the ingestion fail in those cases. I've filed T1123 about this aspect of the problem.