I'd recommend ASN.1 for almost everything that XML is used for. Unfortunately, is a [semi-] human-readable file is in your list of 'needs', then that is "mostly" ruled out.

(So, what you could do is use the XML-encoding of ASN.1, and then use _that_ in the place of your (current) XML, and then simply allow eg DER encoded objects.)